Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, each rated 9.2/10) allow remote code execution with no login and reportedly date back to PHP 5 from 2004. Germany, France, Belgium, Finland, the Czech Republic, Japanese ministries and banks, the BBC, Wikimedia, and the Internet Archive took sites offline while patching. Security firms reportedly used AI models to find and verify bugs that had gone unnoticed for more than a decade.
AI just found a 20-year-old bug in the web's plumbing. Is AI-powered bug hunting good news for defenders or for attackers?
6