Two Critical PHP Vulnerabilities Discovered with AI in 'Black October' Wave
CVE-2026-109618 and CVE-2026-109619 were found with advanced AI models, as industry data counts 2,076 AI-related CVEs in 2026.
Security researchers have confirmed two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that were discovered with the help of advanced AI models. CVE-2026-109618 enables remote code execution through memory corruption. The security community has labelled the period "Black October" because of the wave of AI-assisted vulnerability discovery, and industry tracking recorded 2,076 AI-related CVEs in 2026, roughly half of them affecting agent orchestration tooling.
AI is also being deployed on the offensive side. Threat researchers at Aviatrix documented an agentic campaign that breached 105 e-commerce websites at an estimated cost of about $25 per site, using automation tools such as Hermes, Strix and Cairn. As AI compresses the time between vulnerability discovery and exploitation, organisations running PHP in production are being urged to inventory their runtime versions and apply vendor patches without delay.