GoKawiilAI-discovered PHP bugs expose scale of new RCE threat
Security researchers at Calif (working with OpenAI's Patch the Planet program) and Wiz (owned by Google Cloud) independently found two critical remote code execution vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both teams used frontier AI models, including GPT-5.6 Sol and Gemini 4 Argon, to identify the flaws and build working exploits. One of the bugs had actually been flagged in a 2024 PHP Foundation audit funded by the Sovereign Tech Agency, but was left unpatched because no one could devise a practical exploit at the time.
GoKawiil's interpretation of the reporting above, not reported fact.
The episode suggests AI tools can now turn previously dismissed theoretical bugs into working exploits, which could shrink the window defenders have to patch known weaknesses. It also implies that once a patch or audit note becomes public, attackers and researchers alike may increasingly use AI to race through code diffs looking for exploitable flaws, raising the stakes for how software maintainers triage and disclose vulnerabilities.
- Two critical PHP RCE vulnerabilities were found using frontier AI models by separate security teams at Calif and Wiz.
- One flaw was known since a 2024 PHP Foundation audit but went unpatched due to a lack of a feasible exploit at that time.
- AI's growing ability to convert vague vulnerability descriptions into functional exploits could reshape how quickly software bugs become dangerous.
YubiKey 5C NFC Security Key — With critical RCE vulnerabilities hitting major platforms, locking down your own accounts with hardware-based two-factor authentication is a smart move. A YubiKey adds a physical layer of protection that phishing and credential-stuffing attacks can't easily bypass, which matters a lot when server-side bugs are already making headlines.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: drew.silcock.dev, 2026-10-23
Published there as: “Is this the new cyber normal?”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.