A global security incident highlights a growing challenge
In October 2026, two critical vulnerabilities in PHP, a programming language widely used to power websites and web applications, prompted an urgent response from cyber security teams around the world.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on affected web servers without authentication. Security updates were released, and organisations were urged to identify affected systems and apply the necessary fixes.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code on affected web servers without authentication. Security updates were released, and organisations were urged to identify affected systems and apply the necessary fixes.
The incident highlighted just how far-reaching a vulnerability in widely used technology can be. A weakness in software operating behind a website can create risks for the organisations running it, their customers and the information they hold.
It also brought another important development into focus: the growing role of artificial intelligence in discovering software vulnerabilities that might otherwise remain undetected.
It also brought another important development into focus: the growing role of artificial intelligence in discovering software vulnerabilities that might otherwise remain undetected.
How is AI changing vulnerability discovery?
Software is complex. Even well-established programming languages and applications can contain weaknesses that remain hidden for years.
Traditionally, finding these vulnerabilities has relied heavily on security researchers manually reviewing code, testing applications and investigating unusual behaviour. And while automated security tools have also played an important role for many years, AI is adding another capability to this process.
The recent PHP incident demonstrated the potential of these capabilities. AI-assisted research contributed to identifying critical vulnerabilities in software that underpins a significant part of the internet.
Advanced AI models can analyse large amounts of code, identify unusual patterns, investigate potential weaknesses and help researchers test whether a suspected vulnerability could be exploited. They can also assist with understanding complex code and exploring areas that might otherwise take considerable time to investigate.
This does not mean AI will automatically find every security flaw, or that every discovery will lead to an attack. However, it does mean security researchers have another increasingly powerful tool for uncovering weaknesses in existing technology.
For businesses, the implications are significant.
Software they have relied on for years may contain vulnerabilities that have not previously been identified.
As discovery techniques improve, organisations may need to respond to a growing number of security advisories and updates.The challenge is not just
finding vulnerabilities.
It is responding to them.
Discovering a vulnerability is only the beginning.
Once a weakness becomes known, organisations need to establish whether they use the affected technology, understand how exposed their systems are and take appropriate action.
That can be more complicated than it sounds. Businesses often rely on a mixture of applications, websites, cloud platforms and third-party services. Not every system is managed by the same provider, and some software dependencies may not be immediately obvious.
A business might not develop its own website, for example, but it still needs to understand who is responsible for maintaining the underlying software and applying security updates.
The PHP incident demonstrated why this matters. The vulnerability was not limited to a particular business or industry. Its potential reach reflected how widely the technology is used.
When a critical weakness is identified, delays in understanding the risk or applying a fix can leave systems exposed.
When a critical weakness is identified, delays in understanding the risk or applying a fix can leave systems exposed.
What does this mean for your business?
AI-assisted vulnerability discovery is another reason to take a proactive approach to IT security.Businesses cannot eliminate every software vulnerability, but they can improve their ability to identify risks and respond effectively.
There are several practical steps organisations should consider.
1. Understand your technology environment
2. Keep software updated
3. Know who is responsible for your systems
4. Review your wider security arrangements
Maintain an accurate inventory of your systems, applications and software dependencies.
You need to know what your business relies on before you can determine whether a newly identified vulnerability affects you.
You need to know what your business relies on before you can determine whether a newly identified vulnerability affects you.
Apply security patches and updates in line with their urgency and your organisation's risk.
Critical vulnerabilities affecting internet-facing systems may require immediate action. Updates should be assessed and deployed appropriately rather than left indefinitely.
Critical vulnerabilities affecting internet-facing systems may require immediate action. Updates should be assessed and deployed appropriately rather than left indefinitely.
If your website, software or other technology is managed by an external provider, establish who monitors security advisories, assesses vulnerabilities and applies updates. Make sure there are no gaps in responsibility.
Software updates are essential, but they are only one part of a broader security strategy. Appropriate access controls, monitoring, secure configuration, tested backups and an incident response plan can all help reduce risk and support recovery.
5. Have a plan for
emerging threats
When a critical vulnerability makes the news, businesses need to know how to establish whether they are affected and what to do next. Having access to knowledgeable IT support can help you make informed decisions without wasting valuable time trying to interpret complex technical information alone.
Why having the right IT partner matters
At ACS IT Services, we recognise that technology risks do not always sit neatly within the boundaries of an individual service or support agreement.
During the recent PHP incident, our team proactively contacted customers to explain the issue and help them understand what they could do to mitigate potential risks.
Although PHP is not a service we provide, we understood that the vulnerability could still be relevant to our customers. Sharing information and helping businesses understand emerging issues is an important part of being a trusted IT partner.
As AI continues to improve the ability to discover software vulnerabilities, that wider perspective will become increasingly valuable. Businesses need more than technology that works today. They need to understand the risks that could affect it tomorrow and have the right support to respond.
Prepare your business for what comes next
AI is creating new opportunities to strengthen cyber security, but it is also changing how quickly weaknesses in existing technology can come to light.
The businesses best placed to respond will be those that understand
their technology, take software maintenance seriously and have a
clear plan for managing emerging risks.
The businesses best placed to respond will be those that understand
their technology, take software maintenance seriously and have a
clear plan for managing emerging risks.
You cannot predict every vulnerability.
You can, however, make sure your business is better prepared to deal with one.
Want to take a more proactive approach to your IT security?
ACS IT Services helps businesses manage their IT environments, strengthen their securityand make informed decisions about the technology they rely on.