PHP urgently patches 2 critical vulnerabilities

The PHP project urgently released patches on Wednesday to fix two remote code execution vulnerabilities with a CVSS v4.0 score of 9.2 (CVE-2026-109618, CVE-2026-109619), which researchers call php2shell. As of Wednesday afternoon there was no confirmed exploitation in the wild; CISA said it had not observed exploitation, and several security companies had only observed probing and reconnaissance targeting PHP applications. The vulnerabilities were discovered by the AI security company Calif using OpenAI's cybersecurity model GPT-5.6 Sol; OpenAI said Wiz also independently discovered and reported the vulnerability, and said frontier AI discovered the vulnerabilities before attackers, opening a preparation window for defenders. Wiz researchers said the vulnerability is a memory safety issue that has existed for decades and was previously difficult to exploit because exploit development was complex; AI lowered the cost of developing and adapting complex exploits, changing the economics of vulnerability discovery and exploitation.