AI found two decade-old holes in PHP. RIA says tens of thousands of Estonian servers may be exposed.

On Wednesday the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can let an attacker execute code on a server with a single unauthenticated request. The PHP security team says every PHP installation that serves web requests is at risk and tells all users to update immediately.

PHP sits under WordPress, Drupal, Joomla, Magento and a large share of Estonian company websites, intranets and online shops. RIA told ERR that tens of thousands of servers in Estonia could be vulnerable.

Why this is an AI story

The security firm Wiz found the bugs. In its write-up, Wiz says its researchers used its own Wiz Atlas tool together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The first bug turned up on 19 August. By 21 August Wiz had working attacks against WordPress and Drupal, and it reported the flaws to PHP on 24 August. The vulnerable code had sat in PHP for more than a decade.

Wiz puts the change bluntly: one researcher did in a week what used to take a top team months. The models also adapted the exploit to different applications in hours. Wiz showed code execution against current WordPress, Drupal and Joomla images, and a separate flaw that leaks server memory, which can contain passwords, tokens and API keys.

The same tools are available to attackers. A defender can no longer assume that an old, widely used piece of software has been picked clean, or that a published fix leaves weeks before anyone weaponises it.

How Europe reacted

The European Commission, ENISA, CERT-EU, Europol's cybercrime centre and the network of national CSIRTs issued a joint statement the same day, telling organisations to act now. According to ERR, Finland's state IT centre Valtori closed public government web services as a precaution, Latvia shut state websites, and the Dutch cybersecurity authority took its own site offline.

RIA chose a different route. It told ERR that it saw no national crisis, that protections for important state and public sector sites were in place before the fixes went public, and that it knew of no attacks in Estonia so far. Reports on attacks elsewhere differ, so treat this as a live threat rather than a quiet patch day.

What to do on Monday, or better, today

• ✳List every website, shop, intranet and customer portal you run, including the ones an agency built years ago. For each one, write down who updates PHP: you, your hosting provider or the agency
• ✳Ask your hosting provider in writing which PHP version each site runs and when it will move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Wordfence warned that automatic updates will not install this fix, because the flaw sits in PHP itself
• ✳Treat PHP 8.1 and older as a separate problem. The PHP project no longer ships updates for them, so you need a vendor with backported fixes or an upgrade
• ✳If a public site cannot be patched this week, follow the EU advice: put it behind a web application firewall with the vendor's new rules, or take it offline until it is fixed
• ✳If a site ran unpatched and holds database passwords or API keys in its configuration, plan to change them once it is updated. Wiz showed that one of the flaws can leak server memory
• ✳Check the software you buy too. The EU statement points out that many products run PHP in the background, so ask your suppliers whether they are affected

The longer lesson matters more than this patch. AI has made finding serious flaws in old code cheaper and faster for everyone, and it will happen again. A company that knows what it runs and who patches it can handle the next one in a day. One that has to start by asking the agency which server its website is on will lose a week.