A new Medium report supplies identifiers and operational claims for two alleged PHP vulnerabilities. It names CVE-2026–109618 and CVE-2026–109619, with a severity rating of 9.2. According to the report, attackers need no authentication to execute code remotely, take over servers, steal data and attack website visitors. The bugs supposedly remained undiscovered for more than a decade, or about 12 years.

The article says PHP runs millions of sites and supports WordPress, which it places above 40% of the web. Palo Alto Networks is cited with an estimate of 22.6 million exposed instances. Nicholas Weaver reportedly told Cybersecurity Dive that exploitation is already being detected in the wild. Cisco is cited with a separate estimate that roughly half of internet-facing PHP instances use versions without security support.

The report says CISA and cybersecurity agencies in the UK, Canada, Australia and the EU advised organizations to take affected sites offline until they could patch them. It lists Finland’s public state services, the Netherlands’ national cybersecurity agency website and French prefecture websites among the systems taken offline. Wikimedia is said to have removed some systems temporarily, which disrupted access to parts of Wikipedia.

The NSA reportedly warned that the vulnerabilities could give attackers a direct route to a server’s file system or database. The White House said federal agencies were assessing their PHP use and had learned of the issue on October 16. The article says the patch was due later, but leaked details on social media Tuesday prompted PHP developers to release an emergency fix one day early.

Wiz and OpenAI’s GPT-5.6 Sol are named as the discoverers, with the model operating through the Patch the Planet program. OpenAI described the remediation as intricate and requiring a major change to the PHP engine. The excerpt cites PHP.net for a security advisory and emergency release, but gives no affected versions or fixed PHP version.

The article presents the discovery as evidence that AI is changing defensive security and warns that attackers may use comparable tools after the patch becomes public. It asks how many systems will be breached during the next 72 hours, how operators will update old installations and whether Patch the Planet could become a model for open-source security. It mentions Heartbleed and Log4j as examples of the vulnerabilities such a program might help prevent, and points to large outage risks on legacy systems.

The source notes cite CISA, the NSA, international advisories from October 2026, a White House statement, OpenAI, Wiz, Palo Alto Networks, Cisco, Cloudflare, Cybersecurity Dive, The Wall Street Journal and php.net.