You may already be aware of the PHP bugs story; if not, I’m covering it here. One key is how AI was used to identify these vulnerabilities.

As for the PHP bugs story, here it is: As discussed in The New York Times, security researchers using OpenAI’s advanced AI models unearthed major bugs in a piece of software (known as PHP) used widely across the internet, setting off fears around the world about significant disruptions for consumers and businesses.

The Trump administration and some governments in Europe and Asia warned that all organizations that rely on PHP should immediately install updates released Wednesday to patch the flaws. By some estimates, about 70 percent of all websites and web applications use the software.

PHP is an open-source programming language that helps run website and internet applications. The PHP security team released emergency patch versions to fix the two critical Remote Code Execution (RCE) vulnerabilities known as “php2shell” (CVE-2026-109618 and CVE-2026-109619).

Based on what I’ve read, if your site uses PHP, the minimum safe PHP patch versions you must upgrade to are:

PHP Branch	Minimum Patched Version	Status
PHP 8.5	8.5.12	Fully supported upstream
PHP 8.4	8.4.27	Fully supported upstream
PHP 8.3	8.3.36	Fully supported upstream
PHP 8.2	8.2.35	Fully supported upstream
PHP 8.1 & older	No official releases	End-of-life (EOL) upstream

PHP is a decades-old language that was shorthand for “Personal Home Page,” and is a critical ingredient in popular services like WordPress (on which eDiscovery Today is hosted – you know I checked to make sure the PHP update was applied to my site!) and Drupal. The adoption of PHP is declining and many newer websites are built using technologies not vulnerable to this attack.

The researchers who discovered the bugs work at Calif, a small U.S.-based company of cybersecurity experts who test cutting-edge AI models to see what kind of cyberattacks they can identify and build. Their efforts help alert network defenders to undetected problems in order to fix them before malicious hackers can do damage.

Calif said that it discovered the PHP bugs in only a matter of days. Its researchers used GPT-5.6 Sol for the initial findings, and an unreleased OpenAI model for the exploitation of the flaws.

The PHP bugs problem was just the latest discovery by Calif, which is among a select group of companies, government agencies and research organizations given early access to advanced AI models before they are released publicly. Earlier this year, Calif developed a worm in China’s WeChat communications platform that could have allowed a hacker to rapidly compromise virtually any WeChat account just by calling it. It also used an early version of the Mythos model to bypass security protocols in Apple’s macOS operating system, long viewed as highly secure and difficult to breach.

Getting these models to the ethical hackers first is key to finding vulnerabilities (and making a fix available) before the bad guys find them. Organizations should be prepared to move quickly when patches are identified to protect themselves, as I expect situations like this will become much more common as AI increasingly identifies vulnerabilities like this one.

So, what do you think? Were you aware of the PHP bugs story? You are now! Please share any comments you might have or if you’d like to know more about a particular topic.

Image created using ChatGPT, using the term “robot IT professional applying a band-aid to a computer workstation”.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.