Checked 23 Oct 2026. “Save” describes an AI-assisted, human-led effort to reduce risk, not proof that all attacks were prevented. PHP fixes: 21 Oct. W3Techs 69.3%: 22 Oct, only sites with a known server-side language; not a breach count. AWS reports attempts from 17 Oct, with real-world success unclear. CVSS 9.2 is severity, not breach probability. Models are schematic, not a live scan. Vendor backports may use different version numbers.
Checked 23 October 2026. The title describes a shared effort to reduce risk. No source establishes that AI alone saved every website, prevented all attacks or protected a specific person’s account.
PHP’s official advisory and releases, 21 October: CVE-2026-109618 and CVE-2026-109619 can permit unauthenticated remote code execution under affected conditions. Their CVSS v4.0 severity is 9.2 each, not a probability. Fixed upstream releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Distributions and LTS vendors may supply backported fixes under other package numbers; PHP 8.1 and older lack normal upstream support.
The PHP Foundation’s account, 21 October, traces root-cause concerns to 2024, explains the August 2026 reports and credits the maintainers’ patch work. OpenAI’s account, 21 October, describes Calif’s AI-assisted discovery and coordination. Wiz’s research, 21 October, independently describes discovery, testing and memory-disclosure risk. AI assisted people; it did not create these longstanding PHP flaws.
Amazon Threat Intelligence, 21 October, identifies attempts from 17 October in MadPot honeypot telemetry. The report says it is unclear whether those attempts would have succeeded on real-world systems. These observations do not establish a worldwide victim count, the identity of an attacker, or that an attacker used AI.
W3Techs’ 22 October snapshot: PHP is used by 69.3% of surveyed websites whose server-side programming language can be identified. This denominator is narrower than all websites. Usage is not the fraction unpatched, vulnerable or compromised.
UK NCSC guidance, published 21 October and checked 23 October, advises identifying PHP installations, updating, following vendor guidance and investigating possible compromise. Temporary mitigations have limits; link to the official guidance for operational decisions. A patch does not remove an existing intrusion by itself.
The server, browser, shield and workflow models are editorial schematics. They do not measure network traffic or claim that this page has scanned your device, accounts or server. The article includes the exact figures, patch versions and reporting dates.