AI Helped Find Critical Flaws in PHP, the Software Behind Much of the Web. What It Means for Fiji's Small Cyber Teams

Disclaimer: This article summarises security vendor reports, news coverage, and government advisories from Fiji, the United States and the European Union. It is not security or legal advice. The situation was still changing as this was written, and sources disagree on some points, including how widely the flaws are being exploited. Check the Fiji CERT advisory site (cyber.gov.fj) and your hosting provider for current guidance. Statements attributed to a company or agency are that party's own account, not something I have independently confirmed.

Most business owners have never heard of PHP, but many websites run on it, including anything built on WordPress.

PHP is a programming language that runs on web servers. This month, two critical flaws were disclosed in PHP itself, and the security firm Wiz says AI tools helped it find them and build working exploits. Fiji's Ministry of Policing and Communications and Fiji CERT both issued warnings, with the CERT notice dated 22 October.

This is a global story with a local angle, and the local angle is worth understanding properly.

What Happened

Two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", sit in PHP's core engine. Fiji CERT, CERT-EU and the PHP security team's advisory as relayed by Patchstack all rate both at 9.2 on the CVSS severity scale. An attacker can reportedly exploit them over the internet without logging in.

How many versions are affected: Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to version 5.4.
The fix: PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 (UTC), which was already 22 October in Fiji and Australia. PHP 8.1 and older no longer receive updates from the project, although minimal backports exist for 7.4, 8.0 and 8.1, and some vendors provide their own fixes.
A leak before disclosure: Patchstack and watchTowr both report that details of the flaws leaked on 20 October, before the coordinated disclosure.
What an attacker could do: Wiz demonstrated unauthenticated remote code execution against the latest official container images of WordPress, Drupal and Joomla, and says process memory exposed by the flaws may contain passwords, authentication tokens, API keys and certificates. Because the flaw is in PHP itself, Patchstack says any site on a vulnerable version is exposed, whatever application it runs.
Outages overseas: Reuters, in a story carried by TimesLIVE, reported outages on government websites in Europe and elsewhere beginning on Wednesday 21 October, after the PHP weaknesses were found. It said some operators took their sites offline until they could make them safe.
Official advice abroad: CISA, the US cybersecurity agency, urged organisations to patch immediately and to take PHP systems offline if they could not be updated promptly. Newsweek reported that the FBI and NSA posted similar advice on 21 October.

How widely the flaws are being exploited is where sources differ. watchTowr says its honeypots observed exploitation in the wild on 21 October. Patchstack's headline says attacks are ongoing, though its own telemetry that day showed mostly probing and no hard evidence of breaches yet. CISA said in its 21 October alert that it had not observed successful exploitation in the wild as of publication. Palo Alto Networks' Unit 42 said it could not confirm that attacks it was tracking were linked to these CVEs, and withdrew an earlier statement connecting them. CERT-EU said public proof-of-concept exploits were circulating, which raises the likelihood that attackers are already exploiting the flaws. Treat the exact extent as unsettled.

Where AI Comes In

Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout its research, and credits Gemini 4 Argon with contributions to finding the first vulnerability, exploit development, attack detection and patch validation. It says AI reduces the effort needed to develop and adapt complex exploits, which makes flaws that once seemed impractical to exploit more viable targets. Its write-up also credits OpenAI and the firm Calif in its acknowledgments. That is Wiz's own account, and I have not seen independent confirmation of how the work was split between people and AI.

Reuters spoke to seven cybersecurity professionals who expect AI-uncovered flaws to cause more disruption. It also reported research from VulnCheck, due to be published, finding that AI helped drive a doubling in the number of digital flaws discovered year on year. Cloudflare's CEO Matthew Prince told Reuters he expects a couple of years in which each week feels like "the sky is falling."

Fiji CERT's 25 October notice on Fortinet flaws makes a similar point, warning that AI-assisted tools may help attackers develop exploit code more quickly after patches are released.

There's a counterpoint. Reuters reported that Daniel Stenberg, the lead developer of curl, argues that AI-found vulnerabilities tend to be exotic bugs that are hard for attackers to exploit.

One caution on the headline numbers: Wiz says PHP "powers 70% of all websites in the world" and gives no source for the figure. Newsweek cites a narrower estimate, about 69.3% of sites with an identifiable server-side language. How many sites are actually exposed depends on version, configuration and hosting.

What Fiji Has Done

Fiji's Ministry of Policing and Communications issued an advisory warning organisations of a critical PHP vulnerability, as reported by The Fiji Times. It urged them to check whether their systems use PHP, update immediately, install the latest security updates as soon as possible, review internet-facing systems for exposure, and monitor for unusual activity. It pointed organisations to Fiji CERT's advisory site, cyber.gov.fj. The Fiji Times article does not name any specific Fiji system as affected.

Fiji CERT published its own notice on 22 October, relaying an advance warning from the PHP Foundation. It lists both CVEs and says full details were scheduled for public disclosure on Thursday 22 October at 0100 AEDT.

Affected versions: PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35. PHP 8.1 and older are unsupported, with minimal backports for 7.4, 8.0 and 8.1. The server types listed include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.
Immediate actions listed: find every system running PHP, update to a patched version, ask your vendor about backports for older versions, make sure critical systems are backed up, keep incident response procedures current, and monitor official PHP advisories.
If you cannot update straight away: the notice says "Only an update is a complete solution." It lists interim measures that reduce exposure to specific attack paths, and warns not to rely on ini_set() or .user.ini files.

The notice does not mention small businesses. It addresses "organisations and individuals" in general terms.

What a Fiji Website Owner Should Ask

This is where the global story becomes practical. Based on the Fiji CERT notice and Patchstack's guidance, not Fiji-specific data:

Does your website run on PHP? If it's built on WordPress, Drupal or Joomla, the answer is yes.
Who looks after the server? Because the flaw is in PHP on the server, updating WordPress or its plugins is not the fix. On shared hosting, your host usually controls the PHP version. Patchstack says hosts and Linux vendors received patches in advance and tells users to check with their vendor.
Ask your host a direct question: does the PHP version serving my site include the fix for both CVEs?
Make sure you have a backup you could actually restore. Our guide to protecting your business data covers the basics.

If you can't see your host's patch status, that's the real finding. You may be relying on a provider whose security you cannot check.

Context: Earlier Warnings and a Small Team

Fiji CERT has warned about website and hosting risks before. In May it relayed a notice about active exploitation of a critical cPanel/WHM flaw, which it said affected products managed by several managed service providers and led to their customers being compromised. It told organisations to contact any third party that manages their products to confirm they have been patched. A second May notice described a campaign using compromised WordPress sites to spread information-stealing malware, typically through vulnerable plugins, themes or weak administrator security. These are alerts relayed from vendors and other agencies, so they show what Fiji CERT is passing on, not what has happened in Fiji.

The team handling these notices is small. In a GovInsider interview, Tupou'tuah Baravilala, Director-General for Digital Government Transformation, Cybersecurity and Communications within the Ministry of Policing and Communications, said Fiji has "very small budgets." The article says Fiji CERT has operated since 2025 and that a newly established Security Operations Centre monitors government networks around the clock.

What Is Not Known

Whether any Fiji or Pacific organisation has been compromised. No Fiji incident has been reported in the sources I found.
How many Fiji websites run affected PHP versions, and how quickly local hosting providers have patched.
Whether regional bodies, or Australia's cyber agency, have issued Pacific-specific guidance. None turned up in my searches.
The exact timeline and extent of exploitation, where sources disagree.
Whether more flaws are coming. CERT-EU updated its advisory on 23 October to list a third vulnerability, CVE-2026-115560, with no detail available yet.

What This Could Mean

If AI keeps shortening the time between a flaw being found and an exploit being written, the window in which organisations must patch could keep shrinking. That is hardest on places with small teams. This follows the warnings reported by Reuters, not any Fiji-specific data.

Fiji's reaction looks quick on paper. The CERT notice is dated 22 October, and the PHP fixes were released on 21 October (UTC). That could reflect the new CERT and ministry structure working as intended, though a notice does not show how organisations then acted on it.

Incidents like this also move faster than the rules: Fiji's national AI framework is targeted for 2027, and the Pacific's regional AI principles are voluntary, with a governance framework also due in 2027.

I work with Fijian businesses on IT strategy and infrastructure, and a website that depends on a host you cannot question is exactly the kind of gap worth closing. If you're not sure whether your site or hosting is affected, get in touch.

Sources

All sources below were opened and read while writing this article.