AI model discovers critical vulnerability in PHP core

Researchers have documented a case where a critical vulnerability was discovered in the PHP core, assigned the identifier CVE-2026-109618. The RCE (Remote Code Execution) class vulnerability, with a CVSS 10.0 score, was identified during an automated audit using neural network models, marking a precedent in the field of cybersecurity.

The issue lies within the multipart/form-data parsing mechanism, which had been considered stable for decades and remained largely unchanged due to backward compatibility requirements. Unlike a human, who is prone to trusting time-tested code, the AI model constructed a dependency graph and identified an edge case leading to a buffer overflow before control is passed to the web application.

The incident, dubbed PHP2Shell, demonstrated the ability of neural networks to find zero-day vulnerabilities in fundamental infrastructure elements that power approximately 70% of the modern web. The use of mathematical modeling allowed for the discovery of a bug that traditional static analysis methods had failed to detect for many years.

For security professionals, this case signifies the need to rethink audit strategies for legacy code. AI-based automated systems are now capable of finding critical flaws in code that was previously considered "safe" solely due to its age and widespread adoption.