Patch or take offline: CSA analyzes PHP2Shell and AI-accelerated flaws in foundational components

On October 21, 2026, the PHP project released fixed versions addressing two remote code execution vulnerabilities that can be triggered without authentication, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), with a CVSS v4.0 score of 9.2, affecting all PHP versions released in nearly the past decade. Wiz and OpenAI largely credited frontier AI models for discovering the vulnerabilities, while TechCrunch corrected that the vulnerabilities were found by human researchers and AI was mainly used to build exploits, but both agreed that AI compressed the path from flaw to usable exploit. The US NSA, the UK NCSC, the EU CERT-EU and the Japanese government recommended taking systems offline if they cannot be patched immediately; websites including those of the Edinburgh and Oxford councils and the London Metropolitan Police were temporarily taken offline, and no successful intrusion was confirmed at the time of reporting. CSA categorizes such incidents as a correlated exposure problem, arguing that AI-assisted vulnerability discovery and exploitation is reaching the most widely embedded layer of foundational software, and notes that Amazon had observed exploitation attempts four days before the patch was released.