'Biggest-ever' internet security threat emerges; AI discovers major flaw

A critical internet security threat has emerged following the discovery of major flaws in PHP, a programming language underpinning an estimated 70% of the world's websites. Artificial intelligence models, including OpenAI's GPT-5.6 Sol and tools from Google-backed Wiz, were instrumental in identifying these vulnerabilities, which had been theoretically known for years but were deemed too complex for practical human exploitation. The AI's rapid identification effectively transformed long-standing weaknesses into an immediate global crisis, demonstrating a new frontier in cybersecurity.

The discovered flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated as critically severe, could allow attackers to remotely execute code, disrupt services, and steal sensitive data. In response, cybersecurity agencies worldwide, including the US National Security Agency and Europe's cybersecurity agency, have issued urgent warnings, advising organizations to immediately apply patches released by the PHP project. Numerous websites, including government services in the UK, Finland, Japan, and sections of major platforms, have experienced temporary outages as administrators race to implement fixes or take affected systems offline to prevent exploitation.

The incident has heightened concerns among experts about an impending "vulnerability tsunami," as AI's advanced capabilities can uncover and exploit complex software weaknesses at unprecedented speeds. While AI played a defensive role in this instance, researchers warn that similar AI tools could be weaponized by malicious actors, posing a significant and evolving challenge to internet security and infrastructure.