Last week, the world’s leading Cyber Security experts faced an unprecedented task in fixing two major security flaws in one of the most commonly used programming languages, PHP.
Lecturer in Cyber Security, Hamza Mutaher, talks to us about what happened with the PHP programming language, how the flaws were found and how it changes the future of Computing.
What happened?
On 21 October 2026, two critical vulnerabilities were disclosed in PHP, the programming language behind a large share of the world's websites, including platforms such as WordPress, Drupal and Joomla. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, sit in PHP's core engine and come from how it handles memory when something goes wrong. In some circumstances, an attacker could take control of a vulnerable server without needing to log in, or read sensitive information such as passwords and API keys from its memory. A patch has been released, and the National Cyber Security Centre is urging organisations to act immediately.
How was it found?
The flaws were found by researchers at Wiz using frontier AI models. They discovered the first vulnerability in August, used AI to confirm it could be exploited and to help test the fix, and then reported it privately to PHP's developers so a patch could be ready before the details went public. What's striking is that the flawed code had been in PHP for more than a decade. It wasn't new. It was simply too complex for people to spot and exploit until AI made that practical.
Computing Courses
Find out more about our courses
What does it mean for the future?
We should expect AI to uncover more old flaws hidden in software we have trusted for years. A vulnerability that was once too complicated to exploit may no longer be safe to ignore. That cuts both ways. AI is helping defenders find these weaknesses, but the same capability could help attackers build exploits faster. For me, the real lesson is that vulnerability management needs to move faster than the threats it is meant to stop. Organisations need to know what technology they run, apply patches as soon as fixes are released, and be ready to respond when something goes wrong.
Why build your skills in cyber security and AI?
This is exactly why cyber security and AI are such important fields to study right now. The people who found this flaw needed to understand both how software works and how to use AI responsibly. As AI speeds up both attack and defence, we need more people who can work at that intersection. These skills don't just protect companies. They protect the websites, services and data that all of us rely on every day, and the demand for them is only going to grow. Our course includes module that like software security and applied AI for cyber security that covers this domain
