AI uncovers hidden code flaw that endangers billions of web sites worldwide

For more than ten years, two obscure lines of PHP code silently persisted in the core of the language that powers roughly 70% of websites. Only after intensive scrutiny by cutting-edge AI systems—OpenAI’s GPT-5.6 Sol in partnership with the consultancy Calif and Google’s Gemini 4 Argon used by Wiz—were the vulnerabilities exposed. Designated CVE-2026-109618 and CVE-2026-109619, they enable attackers to run arbitrary code on servers without any password, earning a near-maximum severity score of 9.2.

The discovery sparked a coordinated global response: CERT-EU, the FBI and the NSA issued urgent advisories, and many European governments ordered the temporary suspension of public portals until patches could be deployed. Companies such as Cloudflare assisted in rolling out defensive filters worldwide, while the incident highlighted the growing reliance on AI for frontline cybersecurity.