PHP2Shell: AI-discovered PHP vulnerabilities were exploited before public disclosure
PHP2Shell: Exploitation Before Disclosure for an AI-Found Flaw
The CSA research note reviews two PHP runtime vulnerabilities in PHP2Shell discovered with AI assistance (CVE-2026-109618, CVE-2026-109619); both have a CVSS of 9.2 and allow unauthenticated remote code execution, and the Amazon MadPot honeypot recorded an exploitation attempt on October 17, 2026, four days before public disclosure. Supported branches have been fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but Modat estimates that about 79% of exposed services run branches no longer supported upstream, and the PHP team only provided minimal source backports for 7.4, 8.0, and 8.1. Wiz says its Wiz Atlas platform, together with Gemini 4 Argon and GPT-5.6 Sol, found the first issue on August 19 and demonstrated unauthenticated code execution against WordPress, Drupal, and Joomla.