Error discovered by AI puts part of the world's internet at risk of cyberattack

An error in PHP led to the discovery of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution in the PHP core, potentially compromising data and networks. This vulnerability was found through research conducted by OpenAI models as part of the Patch the Planet initiative, highlighting an instance where artificial intelligence identified a high-impact security flaw in widely used software. In response, entities like the CERT-EU suggested taking systems offline if fixes were delayed, prompting governments across Europe (including the Netherlands, Finland, Germany, Belgium, and France) and the UK to temporarily take sites offline for security updates. Cloudflare began registering initial exploitation attempts immediately upon disclosure, prompting them to deploy protective Web Application Firewall rules. The FBI and NSA have urged organizations to update affected installations immediately or take systems offline, and monitoring for suspicious activity is recommended.

The event illustrates a shift in the security landscape where AI capabilities intersect directly with the discovery of systemic flaws in foundational technologies like widely used programming languages. The finding itself, driven by large-scale model analysis, suggests that advanced pattern recognition can reveal vulnerabilities at an internet scale, shifting the locus of vulnerability discovery from purely human-driven penetration testing to potentially automated analysis. The reaction—involving immediate operational responses from security bodies (CERT-EU) and direct warnings from government agencies (FBI, NSA)—demonstrates an established chain of defense reacting to a novel threat vector. A key implication is the accelerating necessity for proactive patching, as the complexity of the fix required a major change to the PHP engine, underscoring that deep security requires foundational systemic updates rather than superficial fixes. Furthermore, the framework described, termed the "Defender’s Window," suggests an operational model where advanced capabilities can create necessary time buffers for human defense before widespread exploitation occurs. The pattern suggests a trend toward AI acting as a force multiplier in threat identification, which necessitates parallel development in system-level hardening protocols and the legal/policy frameworks governing software safety. What systems are put in place to ensure that vulnerability discovery by automated means translates into commensurate, effective defensive action across all scales?