# Calif and Wiz Used AI in Separate Discoveries of Critical PHP Flaws By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/37622 Published: 2026-10-22T07:52:18.000Z Updated: 2026-10-22T07:52:18.000Z Section: Technology > Calif identified one vulnerability, while Wiz found both. PHP released four patched versions Oct. 21. Calif and Wiz used separate AI-assisted investigations to uncover critical PHP flaws, clarifying the discovery process behind precautionary public-service shutdowns and security updates affecting some crypto systems. Calif identified one of the two vulnerabilities with OpenAI’s GPT-5.6 Sol through the Patch the Planet initiative. Wiz independently found and reported both. Wiz’s first discovery occurred Aug. 19, and its research used its Atlas platform, Google’s Gemini 4 Argon and GPT-5.6 Sol. The findings came from separate teams, rather than a single ChatGPT discovery. No single first discoverer has been established. Patch the Planet brought PHP maintainers, researchers and security providers together for roughly two months of preparation. PHP maintainers led the fixes and release, while other participants tested patches and prepared protections. That coordination matters because PHP runs across many websites and services: maintainers can release a fix, but hosting providers and individual operators must also apply updates to affected systems. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each have a critical Common Vulnerability Scoring System (CVSS) score of 9.2. They can allow an attacker to run code remotely without authentication. Installations handling web requests were at risk, especially Apache servers using mod_php, where an attack could run before application code starts. PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21. [Earlier coverage detailed the affected server configurations and PHP releases](). The same day, Dutch government services including Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. Paris also temporarily closed some city services while teams applied security fixes. The shutdowns showed how a flaw in a shared web runtime can disrupt services run by different organizations. Crypto services using vulnerable PHP systems also had reason to address the flaws. BTCPay Server [updated its optional WooCommerce and WordPress deployment]() and urged merchants using that setup to install the update. The PHP releases remain the fixes for operators running affected versions. ## Links in this article - [Earlier coverage detailed the affected server configurations and PHP releases](https://www.tokenpost.com/news/technology/37442) - [updated its optional WooCommerce and WordPress deployment](https://www.tokenpost.com/news/technology/37597)