Patch as starting gun: the PHP2Shell vulnerability and the AI PoC race

PHP2Shell refers to two critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619); the patch was released on October 21, and Amazon threat intelligence said attackers began exploiting it four days earlier. Attackers used AI to convert the patch diff into exploit scripts, shrinking days of work to hours. Dozens of public PoCs emerged within hours, most of them ineffective; VulnCheck said many work only on x86 or ARM64 with ASLR disabled; 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been fixed, and 8.1 and older versions have no patch.