php2shell: AI-assisted discovery of PHP vulnerabilities affecting up to 70% of websites

The PHP Foundation urgently disclosed two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell) on October 21, 2026, and released fixes at the same time. According to reports, Calif discovered these vulnerabilities with the help of the AI model GPT-5.6 Sol, and the security company Wiz also independently discovered and reported the same batch of vulnerabilities; OpenAI, Google and Cloudflare were listed as response contributors. PHP reportedly supports up to 70% of websites and web applications, and of the 2.6 million hosts scanned by Censys, about 1.5 million were still running unpatched versions after the disclosure. The PHP Foundation urged immediate updates, and systems that cannot be patched in time should be temporarily taken offline; large-scale exploitation in the wild has not yet been confirmed. The article expects more disclosures to publicly credit AI-assisted discovery in the future.