HKCERT warns of critical PHP2Shell vulnerability: enterprises must immediately investigate and patch PHP systems; AI accelerating cyber offense and defense further shortens the response window

HKCERT warns that PHP has two critical vulnerabilities, PHP2Shell (CVE-2026-109618, CVE-2026-109619), which remote attackers can exploit to execute unauthorized code; the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The risk is not limited to web servers; the management interfaces of network, storage, and monitoring devices may also embed PHP. According to public information, researchers discovered the vulnerabilities using AI as early as August 2026, and large-scale scanning attacks have appeared since disclosure; AI is shortening the response window from disclosure to exploitation.