Two critical security vulnerabilities in PHP have raised an important question that goes beyond developers and IT departments: How well do we really understand the systems our businesses rely on? And as AI makes it easier to build software at an increasingly rapid pace, understanding what we build, how it works and how to keep it secure over time becomes even more important.
On October 21, 2026, security updates were released for two serious vulnerabilities in PHP, one of the most widely used programming languages for websites and web applications. Both vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have received a critical severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS). Under certain conditions, they could allow an attacker to execute malicious code on a vulnerable server without authentication.
Sweden’s national cybersecurity response team, CERT-SE, urges affected organizations to update their environments as soon as possible and investigate any signs of compromise. But the incident also highlights a much broader challenge.
Do you know what’s really behind your software?
Today’s IT environments are rarely simple. Behind a website or application, you’ll often find frameworks, libraries, integrations and third-party components working together to keep everything running.
When a critical vulnerability is discovered, organizations need to answer a few fundamental questions quickly: Which systems are affected? Where are the vulnerable components? And who is responsible for fixing them?
It sounds straightforward. In practice, it often isn’t.
Older applications may still be business-critical. Systems may have changed owners or vendors several times. Documentation can become outdated, and technical dependencies may exist in places where visibility is limited.
“One of the biggest challenges in incidents like these is quickly identifying which systems are actually affected so you can prioritize the right actions. Even if your system contains the code where a vulnerability exists, it doesn’t necessarily mean the system is directly affected. Understanding how those components are used within your specific system is absolutely critical – Jonny Lundell, Consulting Manager at Softhouse”
When vulnerabilities are discovered, every minute matters
Once a critical vulnerability becomes public, the time between discovery and remediation can make all the difference. Attackers can quickly analyze published information and attempt to exploit vulnerable systems, sometimes before organizations have had a chance to apply security updates.
AI can accelerate parts of this process, both for those working to protect systems and for those looking for weaknesses to exploit. That doesn’t mean every vulnerability can automatically be exploited using AI, but it reinforces the importance of being able to respond quickly.
That’s why effective security starts long before an incident occurs. Knowing your systems and dependencies, having clear responsibilities and established processes for patching and incident response makes it easier to prioritize the right actions when time is critical.
AI is changing how we build software. Not our responsibility for it.
AI is already transforming software development. We can build, test and experiment faster than before, opening up new opportunities for more people to turn ideas into working digital solutions.
But just because an application works doesn’t automatically mean it’s secure or built to last. Whether code is written by a developer or generated with AI, we still need to understand the architecture, dependencies and technical decisions behind it.
AI-generated code can also contain errors that aren’t immediately obvious. One particular challenge is the tendency to trust AI-generated results without reviewing them carefully enough. That’s why AI needs to be used alongside technical expertise, critical thinking and established quality assurance practices.
“AI gives us incredible opportunities to develop software faster and more efficiently. But being able to generate code isn’t the same as understanding how an entire system works. We still need to review, test, maintain and take responsibility for what we build.”
AI is also part of the solution
There’s an interesting detail in the recent PHP incident. According to Google Cloud, AI models were used to help identify and analyze the vulnerabilities, as well as contribute to developing and validating fixes.
This highlights another side of AI. The same technology that helps us build software faster can also help us identify weaknesses, analyze code and improve security practices.
It’s not about choosing between AI and technical expertise. It’s about combining AI with the right knowledge, methods and experience.
Five questions every organization should be able to answer
For organizations using PHP, the immediate priority is to determine whether their environments are affected and take the necessary security measures.
But regardless of the technology you use, there are a few important questions worth asking:
- Do we know our systems and dependencies? Do we have an up-to-date overview of our applications, components and third-party solutions?
- Do we know who’s responsible? Is there clear ownership of security, updates and ongoing maintenance?
- How do we approach quality and security? Are reviews and testing a natural part of development, or something we address only when problems arise?
- Do we apply the same standards to AI-assisted development? Do we ensure that AI-generated code is reviewed, tested and documented according to the same requirements as any other software?
- How quickly can we respond when something happens? Do we have established processes to identify affected systems, prioritize security measures and deploy updates when time is critical?
Technology changes. The need for reliable software remains.
At Softhouse, we’ve been developing software for 30 years. During that time, we’ve seen technologies, tools and ways of working evolve.
For us, great software development means combining new technology with experience, technical expertise and thoughtful engineering. It means considering the entire software lifecycle, from early architectural decisions to security, maintenance and continuous improvement.
Because technology only makes a real difference when it works in practice and continues to deliver value over time.
Read more about the vulnerabilities
- CERT-SE: Critical Vulnerabilities in PHP (Swedish)
- Google Cloud: Responding to Core PHP Vulnerabilities
- Rapid7: Critical Remote Code Execution in PHP
*This article is based on information published up to and including October 22, 2026. Security recommendations may change as new information becomes available. Always refer to the latest guidance and security advisories from PHP, relevant system vendors and CERT-SE.
