Rival AI Models Uncovered the Same 14-Year-Old PHP Flaw

Three separate cybersecurity teams used competing artificial intelligence models to independently uncover the same 14-year-old software flaw in August, triggering a coordinated global response before attackers could fully weaponize it. The parallel discoveries reveal how advanced AI systems are now capable of autonomously identifying deeply buried infrastructure weaknesses that human researchers missed for over a decade.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed “php2shell,” affect PHP, an open-source programming language maintained by the PHP Foundation. Because PHP underpins roughly 70% of the internet, including platforms like WordPress, which powers about 40% of all websites according to Reuters, the potential blast radius forced governments from Japan to Finland to pull public-facing portals offline. An initial analysis by Palo Alto Networks identified 22.6 million potentially vulnerable instances.

What distinguishes this incident from standard zero-day disclosures is the mechanics of its discovery. Calif, a California-based AI red-teaming firm participating in OpenAI’s Patch the Planet initiative, identified the first issue on Aug. 1 using OpenAI’s GPT-5.6 Sol model. Calif contacted Volker Dusch at the PHP Foundation after determining the language “stood out as a high-impact target,” the company said. A limited version of the bug had been flagged in 2024 but was not considered significant at the time.

OpenAI subsequently investigated the findings and uncovered additional elements of the exploit chain. During conversations with the PHP Foundation, OpenAI learned that Wiz, a Google-owned cybersecurity company, was simultaneously reporting the exact same underlying flaws. Wiz researchers independently identified the vulnerability on Aug. 19 using a combination of Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol, and their own Wiz Atlas platform. French cybersecurity company Quarkslab also joined the effort, according to Cloudflare.

“With 70% of the Internet affected, the impact of php2shell cannot be overstated,” Wiz said in a blog post. “It marks an AI inflection point. The vulnerable code had been there for more than a decade–what AI changed was the ability to understand the weaknesses and turn them into a working exploit.”

The convergence of these independent findings prompted OpenAI to assemble a coalition involving the discoverers, the PHP Foundation, Cloudflare, and multiple U.S. government agencies to manage disclosure and patch development. The FBI’s Cyber Division and the National Security Agency issued statements urging organizations to update immediately. The Prime Minister of Japan and the European Union Computer Emergency Response Team (CERT) released similar directives.

Despite the patches, active exploitation is already underway. Cloudflare CTO Dane Knecht confirmed the network security provider began observing “early attacks” overnight. One startup owner reported that hackers stole source code, exposed cookie data, and leaked legal documents through the flaw, describing the situation as “real bad.”

Gang Wang, Associate Professor of Computer Science at the University of Illinois’ Grainger Engineering, told Fortune that the bugs allow remote code execution on unpatched systems. David Nicol, Director of the Information Trust Institute at the university’s Grainger College of Engineering, warned attackers can use that access as an “entry point into the network hosting that machine, and from there potentially carry out attacks that cause significant damage.”

TJ Sayers, Senior Director of Threat Intelligence at the Center for Internet Security, told Fortune that php2shell demonstrates how AI transforms complex exploit chains into practical attacks. The dual-use nature of these tools remains unresolved. OpenAI acknowledged in a blog post that while AI uncovers security flaws with internet-scale impact, “the same capabilities can also help attackers rapidly develop offensive tools and exploits.”

PHP’s ubiquity makes remediation difficult. The language started as a small project in 1994 and grew alongside the modern web. Facebook launched on PHP in 2004 before migrating away in 2020. Sites currently running the language include Microsoft.com, Wikipedia.org, Archive.org, which is temporarily offline, Theguardian.com, and Baidu.com, according to w3techs. OpenAI co-founder Greg Brockman noted in a post that PHP was his “first programming language.”