AI Helps Find a Major Web Flaw with 4,700 UAE Servers Flagged as Potentially Exposed

Nearly 4,700 internet-facing servers in the UAE were flagged as potentially exposed to a serious web software flaw, according to data from the security firm Censys reported by Khaleej Times on 25 October. With the assistance of artificial intelligence, security researchers uncovered a vulnerability in PHP, the underlying software powering nearly 70% of websites globally. Following the release of an official patch, Dubai-based web agency Grafdom confirmed it has successfully fortified multiple client websites.

What happened

Security researchers at Wiz, Calif, and OpenAI leveraged artificial intelligence tools to discover and demonstrate two critical vulnerabilities in PHP; the server-side programming language underlying a vast portion of the web, including most WordPress sites. Both security flaws carry a severe rating of 9.2 out of 10. If exploited, they enable unauthorized attackers to execute arbitrary commands directly on a site's host server without authentication.

The vulnerability resides within the underlying server environment rather than the web application layer with standard updates to WordPress core, themes, or plugins not resolving the exposure. WordPress.org confirmed that no platform-level update is necessary or planned. Remediation requires upgrading the server's PHP installation directly, a task typically handled by web hosting providers or systems administrators.

What the numbers show

Censys, a security firm that scans the internet, counted 4,691 internet-facing hosts in the UAE as potentially exposed. That is 79.5 per cent of the country's hosts where the PHP version could be identified as reported by Khaleej Times on 25 October. The figure is a snapshot, and some of those hosts may have been updated since. It measures potential exposure based on detected version numbers, not confirmed breaches.

Attacks are no longer theoretical. Amazon's security team recorded the first attempts on 17 October, four days before the fix. On 26 October the US government's cyber agency added both flaws to its list of vulnerabilities known to be exploited. By 27 October, researchers at Delft University had tracked more than 50,000 attack attempts from over 600 addresses in 70 countries.

That does not mean every unpatched website has been breached. Researchers say turning these flaws into reliable attacks on ordinary websites is harder than the volume of attempts suggests, but a site that has not been updated remains at risk.

"Many business owners assume that keeping WordPress and its plugins up to date is enough. In this case it is not, because the weakness is in the server software underneath the website," said Adnan Shakir, Head of Technical Development at Grafdom. "Owners do not need to understand the technical detail. They need to ask their web host or developer two things: has the server's PHP been updated, and has anyone checked for unusual web activity?"

"The fact that AI helped find these flaws means serious weaknesses will be found faster in the future. Businesses need a routine for updating their servers, not a one-off rush every time a warning appears," Shakir added.

What Grafdom did for clients

Since the fix was released, Grafdom has updated and checked over a dozen websites for clients in Dubai and Abu Dhabi. For an online store, a server problem can mean lost sales and lost customer trust. For a property website, it can put enquiries and customer details at risk. In both cases the damage is to the business long before it looks like a technical problem.

What business owners should do now

1. Ask your web host or developer to confirm the update. The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosts apply the fix without changing the version number, so ask for confirmation rather than checking the number alone.
2. Check for unusual web activity. Look for admin accounts you do not recognise, new files you did not add, or unexplained server activity.
3. Change passwords and access keys stored on the server if you have any doubt. One of the flaws can also expose information held in the server's memory.
4. Replace old software. PHP 8.1 and older no longer receive official fixes. Sites running them need a patch from the host or vendor, or an upgrade.
5. List every website and server you run, including old test sites. Forgotten servers are the most common gap.

Notes for editors

Technical names: the flaws are known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 (CVSS v4.0). The "US government's cyber agency" is CISA, which added both to its Known Exploited Vulnerabilities catalogue on 26 October 2026.

UAE figure: Censys data as reported by Khaleej Times on 25 October 2026. It is a point-in-time count of hosts potentially exposed, based on detected PHP versions.

"Roughly seven in ten websites": PHP is the server language on 69.3% of websites where the language is known (W3Techs, October 2026).

Established in 2005, Grafdom stands as a leading digital and technology agency in the UAE. The firm specializes in developing, designing, and managing web platforms for prominent enterprise organizations, international corporations, and local businesses across Dubai and Abu Dhabi. It serves as a key strategic partner for executive teams, offering expert technical guidance and project oversight.