Twenty-four hours after emergency fixes were released for two critical PHP vulnerabilities, governments have taken websites offline, banks have suspended services, and Cloudflare reports millions of exploitation attempts. The flaws, known as CVE-2026-109618 and CVE-2026-109619, score 9.2 out of 10 for severity and allow attackers to potentially execute code on vulnerable servers without authentication. What makes this incident particularly significant is that artificial intelligence helped researchers discover vulnerabilities in code that had survived years of human review. This episode examines the confirmed global response, explains the technical nature of the threat in plain language, explores the implications of AI-assisted vulnerability discovery, and provides urgent guidance for small businesses that need to verify whether their systems are patched and check for signs of prior compromise. Installing a security update does not automatically remove an attacker who gained access beforehand. The fundamental question has shifted from who is responsible for patching your website to whether they patched it in time, and whether anyone was already through the door.
