PHP2Shell vulnerability that lay dormant for over a decade urgently patched, affecting about 70% of websites

1. 05:18
   X@PHPSiteAudit· Discussion

   Checking these flaws one at a time is how the chain gets missed. PHP2Shell (CVE-2026-109618 / CVE-2026-109619) is the…(opens the original post in a new tab)
2. 03:11
   X@georgiaweidman· Discussion

   PHP2Shell had two critical vulnerabilities. Then a THIRD was disclosed. 😬 And the original patches didn’t fix it. CV…(opens the original post in a new tab)
3. 03:07
   X@aarondfrancis· Discussion

   The PHP vulnerability wasn't easy to exploit, but please know that it *is* exploitable. Please make sure you patch if…(opens the original post in a new tab)
4. 00:13
   X@PHPSiteAudit· Discussion

   Yes — and if you run a site, the news is a call to check the PHP version itself. PHP2Shell (CVE-2026-109618 / CVE-2026…(opens the original post in a new tab)

1. 21:34
   X@grok· Discussion

   Oui, c’est PHP2Shell (CVE-2026-109618 et 109619) : deux failles critiques dans le moteur PHP lui-même, notées 9,2, perm…(opens the original post in a new tab)
2. 19:06
   X@PHPSiteAudit· Discussion

   Good flag — and worth spelling out the chain, because it's easy to half-patch: PHP2Shell (CVE-2026-109618 / CVE-2026-1…(opens the original post in a new tab)
3. 19:05
   X@ita_ipo· Discussion

   🐦 🚨 CISA KEV: PHP2Shell RCE chain CVE-2026-109618/109619 actively exploited, used to root servers worldwide. Also in-t…(opens the original post in a new tab)
4. 18:13
   X@PHPSiteAudit· Discussion

   Fair point — and it cuts both ways. WordPress 7.1.4 fixes WordPress flaws. It does not patch PHP itself. PHP2Shell (…(opens the original post in a new tab)
5. 17:30
   X@letsexploit· Discussion

   Your PHP server may still be exposed ⚠ PHP2Shell (CVE-2026-109618 + CVE-2026-109619) can allow code execution without…(opens the original post in a new tab)
6. 17:21
   X@_BabatundeQodri· Discussion

   @Techparleynews @ThePHPF @php_net. PHP2Shell: two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can enable u…(opens the original post in a new tab)
7. 14:59
   X@KasperskyKSA· Discussion

   PHP2Shell: Why should everyone pay attention? Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, c…(opens the original post in a new tab)
8. 14:42
   WebcnBeta· Media coverage

   AI has found vulnerabilities the internet hid for years; the people fixing them can barely keep up(opens the original post in a new tab)
9. 13:10
   X@M29QZGPdFJ35588· Discussion

   Looking back at the php2shell (CVE-2026-109618, CVE-2026-109619) uproar, the reason http2shell (Brotli CVE-2026-111497) doesn't get as much attention is likely the way the information was presented / the presence or absence of alarmists…(opens the original post in a new tab)
10. 12:57
    WebAI Threat Watch (aithreat.io)· Media coverage

    Эра AI-Driven Zero-Day: как уязвимость PHP2Shell навсегда изменила DevSecOps и кибербезопасность(opens the original post in a new tab)
11. 09:51
    X@PHPSiteAudit· Discussion

    Important distinction in this chain — and it makes PHP2Shell worse, not better. PHP2Shell (CVE-2026-109618 / 109619) i…(opens the original post in a new tab)
12. 04:30
    X@wordfence· Discussion

    PHP2Shell Update: Still No Confirmed WordPress Compromises - Here's what we've seen from protecting over 5 million Word…(opens the original post in a new tab)
13. 01:04
    X@SecurityAr58409· Discussion

    🔒 #CyberSecurity CVE-2026-109618: PHP2Shell Unauthenticated RCE Actively Exploited — Detection, … "On Monday, the U.S…(opens the original post in a new tab)

1. 23:51
   X@darkmatrx· Discussion

   Last week: a 14-year-old flaw in the code behind 69% of websites. Now: the US government confirms attackers are using i…(opens the original post in a new tab)
2. 21:50
   WebBleepingComputer· Media coverage

   Even after PHP2Shell, blast radius matters more than a CVSS score(opens the original post in a new tab)
3. 20:49
   CSA Labs Research

   Patch or take offline: CSA analyzes PHP2Shell and AI-accelerated flaws in foundational components

   On October 21, 2026, the PHP project released fixed versions addressing two remote code execution vulnerabilities that can be triggered without authentication, CVE-2026-109618 and CVE-2026-109619 (collectively PHP2Shell), with a CVSS v4.0 score of 9.2, affecting all PHP versions released in nearly the past decade. Wiz and OpenAI largely credited frontier AI models for discovering the vulnerabilities, while TechCrunch corrected that the vulnerabilities were found by human researchers and AI was mainly used to build exploits, but both agreed that AI compressed the path from flaw to usable exploit. The US NSA, the UK NCSC, the EU CERT-EU and the Japanese government recommended taking systems offline if they cannot be patched immediately; websites including those of the Edinburgh and Oxford councils and the London Metropolitan Police were temporarily taken offline, and no successful intrusion was confirmed at the time of reporting. CSA categorizes such incidents as a correlated exposure problem, arguing that AI-assisted vulnerability discovery and exploitation is reaching the most widely embedded layer of foundational software, and notes that Amazon had observed exploitation attempts four days before the patch was released.

4. 20:19
   WebAI Threat Watch (aithreat.io)· Media coverage

   Researchers warn of surging law firm cyber attacks fueled by AI(opens the original post in a new tab)
5. 19:04
   WebAI Threat Watch (aithreat.io)· Media coverage

   Hackers exploit critical PHP flaws in the wild(opens the original post in a new tab)
6. 17:15
   WebAxios· Media coverage

   Inside "Black October": AI's cyber scare delivers a Y2K lesson(opens the original post in a new tab)
7. 17:04
   WebThe New York Times · Technology· Media coverage

   AI Is Finding a Flood of Bugs, and Silicon Valley Is Rushing to Fix Them(opens the original post in a new tab)
8. 17:00
   WebAI Threat Watch (aithreat.io)· Media coverage

   Cette faille identifiée par une IA aurait pu entraîner une catastrophe de cybersécurité(opens the original post in a new tab)
9. 13:05
   WeChatDoonsec· Media coverage

   AI-driven cyberattacks cost less, new challenges facing website security defenses(opens the original post in a new tab)
10. 12:47
    X@cesium_cat· DiscussionIn Chinese, as written

    10/28（三）20：30【 #資知通鑑 EP.4 】 PHP2Shell事件到底有多危險？ 在這起事件中我們又能做些什麼來保護自己？ https://youtube.com/live/Ezz8bkPflG4?feature=share…(opens the original post in a new tab)
11. 12:00
    WebAI Threat Watch (aithreat.io)· Media coverage

    PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority(opens the original post in a new tab)
12. 07:35
    WebIThome (China)· Media coverage

    US CISA confirms hackers have exploited a high-severity PHP vulnerability to carry out attacks, requiring federal civilian agencies to complete system remediation within 3 days(opens the original post in a new tab)
13. 07:15
    X@l0rdmalware· Discussion

    🇺🇸 CISA agregó CVE-2026-109618 y CVE-2026-109619 (PHP2Shell) a su catálogo KEV por explotación activa. Plazo federal: 2…(opens the original post in a new tab)
14. 06:28
    X@Truviber· Discussion

    php2shell is two critical PHP bugs (CVE-2026-109618 and -109619) that let attackers run code on a web server with no lo…(opens the original post in a new tab)
15. 06:25
    X@0xwolverines· Discussion

    The number most worth remembering about PHP2Shell is not 9.2, but that only 5 days passed from the official patch release to CISA listing it as "exploited." Facts (according to CISA notices and summaries on security circles on X): two PHP vulnerabilities CVE-2026-109618, CVE…(opens the original post in a new tab)
16. 06:19
    X@chris_uk2026· Discussion

    🚨 CISA confirms PHP2Shell (CVE-2026-109618/109619) is being actively exploited in the wild for remote code execution. P…(opens the original post in a new tab)
17. 05:10
    iThome (Taiwan)

    Critical vulnerability PHP2Shell reported to be successfully exploited by hackers to execute Shell commands on servers
18. 04:45
    X@PHPSiteAudit· Discussion

    Good question — and yes, the window is the point with PHP2Shell. CISA added CVE-2026-109618 and CVE-2026-109619 to KEV…(opens the original post in a new tab)
19. 04:36
    X@ChrisWells79450· Discussion

    Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) allow unauthenticated RCE, and exploitation has bee…(opens the original post in a new tab)
20. 04:35
    X@Lumideezy· Discussion

    How is your team adapting incident response for AI-accelerated vulnerability disclosures like PHP2Shell? Are you seei…(opens the original post in a new tab)
21. 03:48
    X@calgaryoil· Discussion

    @PaloAltoNtwks What the meme ? Hows the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) emergency ho…(opens the original post in a new tab)
22. 03:45
    X@calgaryoil· Discussion

    @PaloAltoNtwks Hows the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) emergency hotfixes going?(opens the original post in a new tab)
23. 03:30
    X@chevonphillip· Discussion

    PHP2Shell (CVE-2026-109618, CVE-2026-109619) hit CISA's KEV list Monday. Unauthenticated RCE, CVSS 9.2, in mod_php, PHP…(opens the original post in a new tab)
24. 02:39
    WebAI Threat Watch (aithreat.io)· Media coverage

    Last Week’s Critical PHP Warning Was the Tip of the Web Vulnerability Iceberg(opens the original post in a new tab)
25. 02:15
    WebAI Threat Watch (aithreat.io)· Media coverage

    AI Breakthrough at the Foundation Level Triggers a Nuclear-Scale Cybersecurity Storm: PHP Vulnerability Tests Global Defenses(opens the original post in a new tab)
26. 01:37
    Cobalt Security Research

    Patch as starting gun: the PHP2Shell vulnerability and the AI PoC race

    PHP2Shell refers to two critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619); the patch was released on October 21, and Amazon threat intelligence said attackers began exploiting it four days earlier. Attackers used AI to convert the patch diff into exploit scripts, shrinking days of work to hours. Dozens of public PoCs emerged within hours, most of them ineffective; VulnCheck said many work only on x86 or ARM64 with ASLR disabled; 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been fixed, and 8.1 and older versions have no patch.

1. 23:48
   X@jgreigj· Discussion

   CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities list on Monday night But the fed…(opens the original post in a new tab)
2. 23:44
   X@Lumideezy· Discussion

   CISA has added PHP2Shell (CVE-2026-109618 & CVE-2026-109619) to the KEV catalog. These unauthenticated RCE flaws…(opens the original post in a new tab)
3. 23:44
   XBOW

   PHP2shell: Patch Today, Then Prove It
4. 22:51
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP2Shell: hackers ya explotan los fallos críticos de PHP(opens the original post in a new tab)
5. 22:02
   WebAI Threat Watch (aithreat.io)· Media coverage

   La IA descubrió una vulnerabilidad "oculta" durante más de una década(opens the original post in a new tab)
6. 21:30
   X@ZeroThreat_ZT· Discussion

   PHP2Shell: Unauthenticated PHP RCE explained. Explore CVE-2026-109618 and CVE-2026-109619, how the vulnerabilities wor…(opens the original post in a new tab)
7. 21:02
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP2Shell : le mea culpa de la PHP Foundation dévoile une faille bien au-delà du code source…(opens the original post in a new tab)
8. 16:42
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP2Shell делает 70% веба уязвимым к удалённому выполнению кода, пока ИИ обнаруживает многолетние уязвимости(opens the original post in a new tab)
9. 16:20
   WebBleepingComputer· Media coverage

   CISA confirms PHP2Shell vulnerabilities now exploited in attacks(opens the original post in a new tab)
10. 11:17
    X@Daily_CyberSec· Discussion

    CISA adds PHP2Shell flaws CVE-2026-109618 and CVE-2026-109619 to the CISA KEV catalog after confirmed RCE and suspected…(opens the original post in a new tab)
11. 09:30
    Business Insider Japan

    AI-discovered PHP vulnerability disclosed early, triggering cybersecurity panic

    Chainguard CEO丹·洛伦克提前公开了一个影响全球约70%网站的PHP漏洞，打乱了补丁应用期间信息应保密的协调披露安排，引发网络安全恐慌。该漏洞由AI工具历时数月发现、OpenAI担任协调方，美英欧澳加网络当局于10月21日相继发布紧急警告，多国政府预防性关停网站。Cloudflare CEO马修·普林斯称利用尝试从公开前的数千次增至数百万次，AWS称漏洞已在真实环境中被广泛利用，但暂未确认大规模入侵。洛伦克在LinkedIn道歉，同时向POLITICO称因漏洞已遭利用才决定提前披露；PHP Foundation则指其单方面破坏披露协议。文章称，这一事件令网络当局自先进AI工具问世以来担忧的事态成为现实。

12. 03:37
    XX @_NathanCalvin· Discussion

    Super interesting. The best open weight models still can't quite exploit the php bug autonomously - it's also hard enough that it takes M...(opens the original post in a new tab)
13. 03:19
    WebAI Threat Watch (aithreat.io)· Media coverage

    PHP : faille critique, retraits de sites et ruée des hackers(opens the original post in a new tab)
14. 01:44
    X@0xZenoUsman· Discussion

    @FelipeDaragon @killua99 I think they fixed PHP2Shell vulnerability only not the brotli in newer versions(opens the original post in a new tab)
15. 00:30
    X@securitymag· Discussion

    PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been exploited in the wild. Learn more: https://…(opens the original post in a new tab)

1. 23:30
   X@t_nihonmatsu· Discussion

   Regarding PHP2Shell (CVE-2026-109618 / CVE-2026-109619): at this point, what can be clearly identified as an organization actually carrying out and succeeding at an attack is the attempt by a botnet (Mirai-family) and CYFIRMA's D… with moderate confidence(opens the original post in a new tab)
2. 22:25
   WebAI Threat Watch (aithreat.io)· Media coverage

   Une faille PHP montre que « l’apocalypse des vulnérabilités » liée à l’IA est dans les temps : le PDG d’Immunefi(opens the original post in a new tab)
3. 22:25
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP flaw shows AI ‘vulnerability apocalypse’ is on schedule: Immunefi CEO(opens the original post in a new tab)
4. 18:57
   RedditReddit r/artificial· Discussion

   AI is exposing how fragile the web really is. What you can do to stay safe(opens the original post in a new tab)
5. 18:04
   WebAI Threat Watch (aithreat.io)· Media coverage

   70% of websites caught up in PHP vulnerability alert: as AI starts finding vulnerabilities on its own, how should enterprises defend?(opens the original post in a new tab)
6. 17:19
   WebBleepingComputer· Media coverage

   PHP2Shell security flaws now sucessfully exploited in the wild(opens the original post in a new tab)
7. 16:45
   WebAI Threat Watch (aithreat.io)· Media coverage

   The first confirmed victim case in which hackers exploited a security vulnerability in the core web program "PHP" to intrude into a real government agency. The hackers put artificial intelligence (AI) into practical use, shortening the time required from intrusion to control to 2 hours, and the defense situation of national information infrastructure has suddenly become strained. The attacker's specific..(opens the original post in a new tab)
8. 16:14
   X@DuckButTurttle· Discussion

   PHP2Shell (CVE-2026-109618 / CVE-2026-109619): CYFIRMA reports low-volume scanning of 216 unpatched hosts and links it…(opens the original post in a new tab)
9. 15:45
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP2Shell : la faille PHP et la divulgation qui a dérapé(opens the original post in a new tab)
10. 13:58
    X@xiaoche527· DiscussionIn Chinese, as written

    AI找漏洞的速度，已经快过人类打补丁。PHP2Shell只是第一枪。 OpenAI参与挖出的两个PHP远程执行漏洞，最早藏在2012年的5.4版。Cloudflare说披露2小时内攻击尝试几十万次，随后上百万。 赢家是卖防御的。输家是所有…(opens the original post in a new tab)
11. 13:17
    X@sxkshii_26· Discussion

    PHP2Shell: two CVSS 9.2 PHP flaws (CVE-2026-109618/109619) allow unauthenticated RCE, before app code runs. Fixed in 8.…(opens the original post in a new tab)
12. 12:16
    WebAI Threat Watch (aithreat.io)· Media coverage

    AI uncovers a high-severity vulnerability hidden for over a decade; the internet may be in for turbulent times(opens the original post in a new tab)
13. 11:04
    X@0xdownlink· Discussion

    Our read: PHP2Shell needs patching now, but attempts, exposure counts and vendor headlines aren't victims. Quiet bugs w…(opens the original post in a new tab)
14. 10:35
    WebAI Threat Watch (aithreat.io)· Media coverage

    A dark October: 45 minutes after a PHP vulnerability was made public, attack volume surged a hundredfold(opens the original post in a new tab)
15. 08:33
    X@Daily_CyberSec· Discussion

    PHP2Shell affected products list: vendor patch status for CVE-2026-109618 and CVE-2026-109619 across PAN-OS, QNAP, Cisc…(opens the original post in a new tab)
16. 08:20
    X@tchsignal· Discussion

    AI Agents and PHP2Shell: What the Evidence Actually Shows Did AI agents actually exploit PHP2Shell? A critical correct…(opens the original post in a new tab)
17. 07:24
    X@InfraWatchHQ· Discussion

    Correction on PHP2Shell (CVE-2026-109618/109619): Palo Alto Networks Unit 42 has retracted its Oct 23 update. The attac…(opens the original post in a new tab)
18. 07:02
    X@TonyBeeTweets· Discussion

    PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert thehackernews.com/2026/10…(opens the original post in a new tab)
19. 03:30
    X@2Workly· Discussion

    PHP2Shell (CVE-2026-109618) under active exploitation. Look for POST 500 errors, PHP heap corruption, and Apache crashe…(opens the original post in a new tab)
20. 01:45
    X@Deil_Nonaghy· Discussion

    PHP2Shell (CVE-2026-109618/-109619) went public 21 Oct. Amazon saw it being exploited on 17 Oct. Patch, then hunt back…(opens the original post in a new tab)
21. 01:11
    X@fengwan217· Discussion

    [PHP's hole was hidden for ten years, AI turned it into a gun] On October 21, PHP urgently released a patch. Two IDs, CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2. The name is PHP2Shell—no login needed, a single request can run arbitrary… on the server(opens the original post in a new tab)
22. 00:44
    WebcnBeta· Media coverage

    Cloudflare warns that AI is accelerating the discovery of software vulnerabilities, and the internet may face years of security turbulence(opens the original post in a new tab)
23. 00:44
    WebAI Threat Watch (aithreat.io)· Media coverage

    Cloudflare warns that AI is accelerating the discovery of software vulnerabilities, and the internet may face years of security turbulence(opens the original post in a new tab)
24. 00:44
    WebAI Threat Watch (aithreat.io)· Media coverage

    Cloudflare warns that AI is accelerating the discovery of software vulnerabilities, and the internet may face years of security turbulence(opens the original post in a new tab)
25. 00:39
    X@GGASecDe· Discussion

    Research: we reproduced CVE-2026-109618/109619 on php:8.4.26-apache (aarch64). Pure HTTP - no gdb, no /proc on target.…(opens the original post in a new tab)

1. 23:24
   X@PhotoZel· Discussion

   PHP2Shell (CVE-2026-109618/19): Broadcom & VMware Impact & Mitigation – #vExpert Christopher Kusek, PKGuild htt…(opens the original post in a new tab)
2. 21:36
   WebAI Threat Watch (aithreat.io)· Media coverage

   Microsoft: China Hackers Unleash AI-Powered Cyberattacks Targeting Supply Chains(opens the original post in a new tab)
3. 21:34
   WebAI Threat Watch (aithreat.io)· Media coverage

   Sitios web de todo el mundo cierran después de que la IA detectó una vulnerabilidad que afecta al 70% de internet(opens the original post in a new tab)
4. 21:00
   WebAI Threat Watch (aithreat.io)· Media coverage

   Una inteligencia artificial encontró en dos días cómo explotar una falla de PHP abierta durante 22 años(opens the original post in a new tab)
5. 20:47
   Infobae

   AI found a way to exploit a 22-year-old PHP vulnerability within two days

   OpenAI recently disclosed that AI found a way to exploit a critical PHP vulnerability that had existed for 22 years within two days; the vulnerability has been fixed through a security update. The vulnerability could be used to steal passwords and databases, leak information, or take control of websites, and PHP powers about 70% of websites; its risk was warned about as early as July 2004 by security researcher Stefan Esser, and it had previously been difficult to exploit because attackers needed to make the server run out of memory at a precise point in time, relying on slow, repeated manual attempts. On July 30, 2026, researchers at Calif, a security company focused on AI, applied large language models to PHP in OpenAI's Patch the Planet program, found an attack method on August 1, and subsequently found multiple variants; Wiz later found more exploitation methods and called it one of the most severe vulnerabilities in software history. Vulnerability information leaked before the patch was released, and Cloudflare recorded thousands of attack attempts; CrowdStrike noted that old versions of PHP are still running and that the patch may not have solved all the problems.

6. 17:33
   X@3kept1c· Discussion

   Primera evidencia documentada de ejecución remota de codigo (RCE), en ataques reales, usando PHP2Shell. El proyecto de…(opens the original post in a new tab)
7. 17:21
   X@zakpatrik· Discussion

   Dnes se zaměřím na chybu, která ohrožuje 70 % webu. Předpokládám, že o zranitelnostech PHP2Shell a Node2Shell už jste s…(opens the original post in a new tab)
8. 16:20
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP2Shell : une faille critique de PHP déclenche l’alerte mondiale(opens the original post in a new tab)
9. 14:24
   X@DefusedCyber· Discussion

   ⚠php2shell (CVE-2026-109618 and CVE-2026-109619): we’re seeing “P2SB” multipart probes hitting our Palo Alto GlobalPro…(opens the original post in a new tab)
10. 14:06
    WebIThome (China)· Media coverage

    Cybersecurity experts: vulnerabilities found by AI may soon lead to new security risks(opens the original post in a new tab)
11. 13:13
    X@0xmsdbg· Discussion

    php2shell PoC + Detection rules Vulnerablity Researcher Write-up CVE-2026-109618 https://blog.offensive32.com/p/php2she…(opens the original post in a new tab)
12. 13:06
    X@tchsignal· Discussion

    PHP2Shell Exposes New Security Challenges as AI Enters Vulnerability Research Two critical vulnerabilities in PHP have…(opens the original post in a new tab)
13. 12:52
    X@bamitav· Discussion

    The PHP Meltdown Shows How AI Makes Bugs More Exploitable | WIRED #PHP2Shell #PHP #vulnerability #AI #internet #Meltdo…(opens the original post in a new tab)
14. 12:45
    X@cxaqhq· Discussion

    Has PHP2Shell ever been successfully run against a real target? I feel like there's no movement on it now(opens the original post in a new tab)
15. 12:45
    X@BhanuNaik_2026· Discussion

    @CrowdStrike Are any VMware infrastructure products or virtual appliances affected by the critical PHP RCE vulnerabilit…(opens the original post in a new tab)
16. 12:26
    WeChat · LLM Security Research

    PHP2Shell: AI turns a decade-old vulnerability into a weapon, and the sleeping dragon is awakened overnight

    PHP 官方 10 月 21 日紧急修复合称 PHP2Shell 的两个 CVSS 9.2 严重漏洞，缺陷在 Zend 引擎潜伏十余年，Wiz 估计影响约七成互联网网站。安全公司 Calif 借助 GPT-5.6 Sol 发现其中一类缺陷，Wiz 用 Wiz Atlas 叠加 Gemini 4 Argon 与 GPT-5.6 Sol 独立发现两个漏洞，并在 WordPress、Drupal、Joomla 上验证了无需认证的远程代码执行；Wiz 称过去需顶级团队数月的利用开发现在约一周可完成。Cloudflare 统计漏洞公开后 45 分钟利用尝试升至数万次、截至 10 月 22 日累计突破数百万次，暂无确认成功的 RCE 案例。作者判断 AI 压缩了漏洞从存在到可被利用的时间差，修复须升级 PHP 运行时并重启每个 worker，仅更新应用代码无效。

17. 11:21
    X@CryptoAliceTH· Discussion

    🚨 เว็บทั่วโลกไม่ได้ล่มเพราะโดนแฮกแระค่ะ แต่ยอมปิดตัวเองเพราะเจอช่องโหว่ที่ร้ายแรงพอจะทำให้เว็บต้องรีบแพตช์ก่อนโดนเจาะ แ…(opens the original post in a new tab)
18. 10:36
    X@Tesla_Optimus_K· Discussion

    Will AI expose the rickety infrastructure of the internet? PHP2Shell dropped this week. Two core-engine bugs had sat i…(opens the original post in a new tab)
19. 07:57
    Página|12

    PHP vulnerability in the open-source programming language leaves most websites worldwide vulnerable to cyberattacks

    A vulnerability in the open-source programming language PHP has left most websites worldwide vulnerable to cyberattacks, and many websites have been taken offline preventively by administrators. The vulnerability was discovered with the assistance of AI models, and a security patch has been released, but experts expect a wave of hacker attacks using AI to break in before subsequent security updates.

20. 04:34
    WebAI Threat Watch (aithreat.io)· Media coverage

    OpenAI model helps discover PHP vulnerability — The Japan Times(opens the original post in a new tab)
21. 01:59
    WebAI Threat Watch (aithreat.io)· Media coverage

    Hackeos con IA desbordan Internet: falla en PHP expuso al 70% de la web(opens the original post in a new tab)
22. 00:55
    X@Jaxson_Rourke· Discussion

    PHP2Shell: fourteen years of hubris, found by two AIs in weeks. https://x.com/i/article/2114034452599017472(opens the original post in a new tab)
23. 00:02
    WebAI Threat Watch (aithreat.io)· Media coverage

    AI-Driven PHP Vulnerability Triggers Global Cybersecurity Alert(opens the original post in a new tab)
24. 00:01
    X@zerodayalpha· Discussion

    ⚡ 0-Day Alert: PHP remote code execution CVE-2026-109618: OOM bailout to UAF CVE-2026-109619: state corruption to UAF…(opens the original post in a new tab)

1. 23:07
   X@ApollonVisual· Discussion

   AI Finds PHP Flaws in 70% of Web PHP powers about 70% of websites. OpenAI's GPT-5.6 Sol helped researchers find two cr…(opens the original post in a new tab)
2. 05:11
   TIMESelected

   AI-discovered PHP vulnerabilities nearly became a cybersecurity disaster

   Wiz 研究员 Sagi Tzadik 让 AI 智能体把 WordPress 的一个漏洞复现到 Drupal，智能体未成功却顺带找到 PHP 语言一个十余年未被察觉的漏洞。另一家安全公司 Calif 与 OpenAI 合作用 AI 发现了相关漏洞，两家向 PHP 维护者报告后联手，约 15 人的团队几乎每日协作定位共同源头并制定补丁。补丁公开前两天消息走漏，Calif 又误发利用演示视频，Cloudflare 统计到公开前数千次、公开后 45 分钟内数万次、两小时内数十万次攻击尝试，最终达到数百万次。补丁发布后，政府机构与部分维基百科页面被预防性下线。OpenAI 称这些 PHP 漏洞是其已发现并正在修复的多个重要漏洞之一，预计类似发现未来数月将大幅增加。

3. 02:48
   The Guardian · AI

   "Black October": cybersecurity experts warn that AI-assisted hacking has entered a new stage
4. 00:40
   Semafor

   Human complacency created the biggest problem of the AI era

   OpenAI models helped discover a set of PHP vulnerabilities that exposed much of the internet to powerful exploits, and a poor disclosure process let hackers exploit them first. The author says AI did not create this problem; human complacency is the root cause: the vulnerability had existed for over a decade, Stefan Esser had already discovered this class of vulnerability as early as 2004, and the PHP Foundation said that in its 2024 audit it had reasoned about this risk but did not address it.

1. 21:56
   Transformer

   First signs of a cyber disaster? OpenAI project finds major vulnerabilities in PHP and Node.js

   OpenAI's Patch the Planet and Daybreak projects used AI to find two major vulnerabilities in PHP, and separately found one independent vulnerability in Node.js; details leaked before fixes. Government websites and the Internet Archive, among others, urgently went offline to patch; critical infrastructure providers had more than two months to address the vulnerabilities before public disclosure, but many sites need weeks to months to update. OpenAI expects similar findings to increase substantially in the coming months.

2. 20:48
   CSA Labs Research

   PHP2Shell: AI-discovered PHP vulnerabilities were exploited before public disclosure

   The CSA research note reviews two PHP runtime vulnerabilities in PHP2Shell discovered with AI assistance (CVE-2026-109618, CVE-2026-109619); both have a CVSS of 9.2 and allow unauthenticated remote code execution, and the Amazon MadPot honeypot recorded an exploitation attempt on October 17, 2026, four days before public disclosure. Supported branches have been fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but Modat estimates that about 79% of exposed services run branches no longer supported upstream, and the PHP team only provided minimal source backports for 7.4, 8.0, and 8.1. Wiz says its Wiz Atlas platform, together with Gemini 4 Argon and GPT-5.6 Sol, found the first issue on August 19 and demonstrated unauthenticated code execution against WordPress, Drupal, and Joomla.

3. 14:07
   ChosunBiz

   AI can also find security flaws hidden for 20 years… Looking at the "Bugmageddon" panic from the PHP vulnerability incident
4. Time not given
   ZDF

   PHP security vulnerability found by AI: why websites went offline and what to do next

   AI found a serious security vulnerability in the widely used programming language PHP, triggering a global alert: before a security update was available, details of the vulnerability had already been made public, and many website operators, fearing attacks, took their sites offline as a precaution. The NANO program invited Hasso-Plattner-Institut security researcher Christian Dörr to explain how such vulnerabilities arise, the risk to personal data, and why fixing them as soon as possible is crucial.

5. 02:44
   Arctic Wolf

   PHP2Shell: Two critical PHP vulnerabilities can lead to unauthenticated remote code execution

   The PHP development team released an emergency security update on October 21, fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0 (collectively called PHP2Shell), which allow unauthenticated attackers to execute code with the privileges of the affected PHP worker process. Affected deployments include Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, with Apache mod_php listed as the highest-risk configuration; the official fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to OpenAI, the two vulnerabilities were discovered and verified by researchers participating in its Patch the Planet project using frontier models combined with expert human review.

6. 01:39
   X @iapsAI

   Two critical PHP vulnerabilities disclosed this week allow server takeover without login

   Two critical vulnerabilities appeared in PHP this week, allowing attackers to take over servers without logging in. X account @iapsAI posted that PHP supports about 70% of websites worldwide, and that companies and governments are currently racing to patch.

7. 00:11
   Bitdefender

   Bitdefender technical advisory: PHP2Shell pre-authentication remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619)

   Bitdefender published a technical advisory detailing two pre-authentication remote code execution vulnerabilities in PHP, PHP2Shell (CVE-2026-109618, CVE-2026-109619). All unpatched PHP installations that handle web requests are affected, with Apache mod_php at highest risk. Both vulnerabilities have a CVSS v4.0 score of 9.2 and are memory corruption flaws in PHP worker processes; the advisory assesses them as runtime flaws rather than application flaws, and on mod_php, updating the CMS or hardening the application does not change the exposure surface. PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 2026-10-21; the 7.4, 8.0, 8.1 and earlier branches have no official fix, and PHP says updating is the only safe option.

1. 23:41
   Luiza's Newsletter

   AI security alarm: details of PHP vulnerabilities found by GPT-5.6 Sol and Gemini 4 Argon leaked

   Details of two critical PHP vulnerabilities found by GPT-5.6 Sol and Gemini 4 Argon leaked this week, with about 70% of internet sites at risk, according to researchers at Calif (in collaboration with OpenAI) and Google's Wiz. The PHP Foundation acknowledged that it had seen signs of one of the issues in 2024 but did not fix it due to disagreements, technical difficulties and insufficient resources; the NSA recommends immediately installing updates or taking affected systems offline. A U.S. government assessment shows that Z.ai's GLM-5.3 lags the leading U.S. models in cybersecurity capability by only four months and is openly available.

2. 23:11
   CBS News · Technology

   The PHP vulnerability affecting 70% of websites worldwide: what you should know

   Cybersecurity researchers using an advanced OpenAI model discovered a long-standing PHP vulnerability affecting about 70% of websites and web applications worldwide, and named it PHP2Shell; the vulnerability has existed for at least ten years. Wall Street Journal reporter Robert McMillan said that such flaws are extremely complex and manual investigation could take months, whereas AI can complete this tedious and time-consuming task faster. The PHP Foundation said on Wednesday that it had released a fix patch and update instructions; the FBI's cyber division confirmed that the vulnerability could allow attackers to remotely implant malware, and recommended that organizations unable to patch immediately take their websites offline temporarily. Andrés Guerrero-Saade of SentinelOne said that this incident reflects both AI's ability to accelerate vulnerability researchers and its enhancement of attackers' exploitation capabilities, and that the window between patch release and exploitation is being shortened by AI.

3. 22:28
   ndr.de

   PHP security vulnerability: AI may spread threats around the clock

   PHP has exposed a severe security vulnerability. The head of the Hamburg Artificial Intelligence Center says about 70% of websites worldwide are affected. The German Federal Office for Information Security has issued a warning and recommends installing updates. Attackers can use it to steal passwords, redirect users to fake websites to obtain online banking passwords and other transaction data, and websites including those of the Hamburg Artificial Intelligence Center and the University of Hamburg were temporarily offline. Experts say the vulnerability lay hidden in the code for years and was difficult for humans to find, while AI can discover and exploit such vulnerabilities within hours and spread threats around the clock.

4. 22:23
   404 Media

   AI Is Changing Everything About Hacking, and No One Knows What Comes Next

   AI is fundamentally changing hacking offense and defense, and where it goes next is hard to predict. Researchers at Wiz, Calif and OpenAI used AI to find the PHP2Shell vulnerability in PHP, and Cloudflare's CEO said exploitation attempts on its network rose from thousands in the 10 hours before public disclosure to millions today. AI makes probing internet vulnerabilities at scale extremely easy, but remediation deployment may not accelerate equally.

5. 21:46
   The Guardian · AI

   The internet is broken again: two critical PHP vulnerabilities caused some government services in the Netherlands and Finland and some Wikimedia systems to be taken offline. Should tech companies that make billions from open source pay to fix it?

   Two critical PHP vulnerabilities forced some government services in the Netherlands and Finland and some Wikimedia systems to be taken offline, and Cloudflare said it had observed millions of exploitation attempts. The language underpins about 70% of trackable websites, the vulnerabilities score 9.2 on a 10-point scale, and researchers at OpenAI, Wiz and elsewhere have used AI tools to find that they are easily exploitable. Researchers recorded about 48,000 vulnerabilities in 2025 and more than 84,000 already in 2026, and the authors call on tech companies that profit from open source and governments to fund maintenance.

6. 20:33
   CNBC · Technology

   Severe PHP web security vulnerabilities trigger global alert, Google, OpenAI and Amazon join response

   Two severe vulnerabilities were found in PHP (collectively called PHP2Shell) that could allow attackers to remotely execute malicious code on affected servers. The US National Security Agency (NSA), the FBI, and agencies in Singapore, the UK, Australia, Canada and the EU issued alerts, and the NSA advised organizations unable to update immediately to take affected systems offline. Amazon said its MadPot threat detection system had detected exploitation attempts before the vulnerabilities were public, but how attackers learned of the vulnerabilities in advance is unclear. Google said its cybersecurity unit Wiz used AI models to help discover and investigate the vulnerabilities, with Gemini AI participating in assessing the vulnerabilities, testing attacks and validating patches; OpenAI said researchers and its AI models helped discover the vulnerabilities and led a coalition to coordinate fixes during the two months before public disclosure. Cloudflare has deployed protections against PHP2Shell through its web application firewall, and the PHP development team has released security fixes.

7. 20:21
   Semafor

   Web developer sounds alarm on AI-driven cyberattacks

   After a web developer used AI to find a vulnerability affecting most websites worldwide, a series of AI cyberattack warnings intensified concerns that the technology will overwhelm global corporate and government systems. Cloudflare said attempts to exploit the vulnerability surged, Microsoft warned that a China-linked hacking group used AI to breach an IT services company, and commercially available chatbots were reportedly also used to attack banks. A reporter for The Information said AI advances may bring what OpenAI calls the "defender's window" close to closing.

8. 18:30
   Tom's Hardware

   OpenAI says GPT-5.6 Sol helped find a critical PHP vulnerability that could affect 70% of websites

   On October 21, OpenAI said researchers in its Patch the Planet cybersecurity project used GPT-5.6 Sol to discover a critical security vulnerability in PHP. PHP is an open-source programming language estimated to support about 70% of the internet. OpenAI said it then coordinated researchers, PHP maintainers, security vendors and government cybersecurity agencies to complete the fix in two months, and attributed the time required to the complexity of the task and the need for major changes to the PHP engine.

9. 11:53
   mint

   A PHP vulnerability that has existed for over a decade threatens website security: how AI found it, who is affected, and how to protect against it

   Wiz Research discovered two memory safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP core engine; attackers can remotely execute code without authentication and steal passwords, authentication tokens and API keys from server memory; the vulnerabilities were disclosed on October 21, 2026, and PHP released security updates at the same time. PHP powers about 70% of websites worldwide, affected versions date back to PHP 5.4, and any site running an affected version may be exposed; researchers demonstrated attacks on WordPress, Drupal and Joomla, and the vulnerabilities are in PHP itself rather than in these platforms. Wiz said its team used Wiz Atlas, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to locate the vulnerabilities and turn complex memory errors into working exploits, and also used AI to test patches.

10. 11:50
    Qiita

    The people who say "those who still use PHP deserve it" are the most dangerous

    A Qiita author wrote an article rebutting the claim after the PHP2Shell incident that "the people who use PHP are to blame," arguing that the incident's real significance is that AI can now rapidly weaponize memory vulnerabilities dormant in the C/C++ runtime. The timeline the author lays out states that this flaw (CVE-2026-109618 / CVE-2026-109619) was noticed by PHP core developers as early as 2024 but no attack path could be found; in the summer of 2026, security researchers used source-code analysis with models such as GPT-5.6 Sol to turn it into a usable remote code execution attack chain, and another large security company also independently discovered and verified it using an AI agent; after information about the attack chain leaked in October, PHP rushed out a release one day early.

11. 08:00
    Sysdig

    PHP2Shell (CVE-2026-109618 and CVE-2026-109619): detecting unauthenticated remote code execution in the PHP core

    The PHP project released an emergency version on October 21 to fix two unauthenticated remote code execution vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2); attackers can execute code on the server with only an HTTP request. The two CVEs group four memory safety flaws; the common root cause is that a PHP worker, after a fatal out-of-memory error, does not clean up a global pointer pointing to the request heap, and subsequent requests use a stale pointer to freed memory; the affected code dates back to PHP 5.4 in 2012, and the flaw is at the engine layer, so exposure cannot be avoided even if application code is clean. The researcher who reported the vulnerabilities says AI models participated in vulnerability discovery and exploit development; Amazon honeypots had already seen attempts on October 17, and Cloudflare reported early attacks on October 21 at 07:43 UTC, more than six hours before the fix was released.

12. Time not given
    HKCERT

    HKCERT warns of critical PHP2Shell vulnerability: enterprises must immediately investigate and patch PHP systems; AI accelerating cyber offense and defense further shortens the response window

    HKCERT warns that PHP has two critical vulnerabilities, PHP2Shell (CVE-2026-109618, CVE-2026-109619), which remote attackers can exploit to execute unauthorized code; the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The risk is not limited to web servers; the management interfaces of network, storage, and monitoring devices may also embed PHP. According to public information, researchers discovered the vulnerabilities using AI as early as August 2026, and large-scale scanning attacks have appeared since disclosure; AI is shortening the response window from disclosure to exploitation.

13. 07:20
    Financial Times · AI

    Amazon warns: new cyber vulnerabilities discovered using AI are being "widely exploited"

    Amazon warns that new cyber vulnerabilities discovered with the help of AI are being "widely exploited." Researchers used models from OpenAI and Google to find serious flaws in software used by most websites worldwide.

14. 07:04
    Asahi Shimbun AJW

    PHP vulnerability overlooked for over 10 years, discovered by state-of-the-art AI
15. 06:56
    wikitree.co.kr

    PHP, used by 70% of websites worldwide, disclosed to have a critical vulnerability, with countries entering a state of emergency

    PHP was disclosed to have two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of a maximum of 10, allowing attackers to execute malicious code on servers without logging in or additional authentication. The PHP development team moved the update originally scheduled for the 22nd up to the 21st, releasing fix versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Government portals, school- and hospital-related websites in the Netherlands, Finland, Denmark and Belgium and the European Patent Office had suspended some external services, and CERT-EU, ENISA and Europol called for patching as soon as possible. W3Techs data shows that about 75% of websites with an identifiable server language use PHP. According to foreign media reports, a US cybersecurity company discovered the flaw while analyzing PHP code with OpenAI's GPT-5.6 Sol, and Google's security company Wiz separately discovered and reported it, bringing the more-than-decade-old issue to light.

16. 06:44
    Semafor

    AI helps discover vulnerability affecting up to 70% of websites

    After developers, with AI assistance, discovered a vulnerability affecting up to 70% of websites worldwide, France, Denmark, Finland and the Netherlands took government websites offline on Wednesday, and Japan's prime minister urged everyone to act that evening and apply the newly released fix. The co-founder of Google's Wiz cybersecurity team told The Wall Street Journal that this was the most serious vulnerability AI has discovered to date, and said that without AI, humans might not have been able to find it. A cybersecurity researcher told Reuters that AI would enable hackers to reverse-engineer the vulnerability, and that the public fix would trigger an "exploitation race," with hackers' next step being a large-scale compromise of all vulnerable web servers on the internet.

17. 06:34
    WeChat · AI Era (Xinzhiyuan)

    OpenAI discloses two high-severity PHP vulnerabilities found with GPT-5.6 Sol's participation; attacks appeared before the patch was released

    OpenAI disclosed that researchers, with the help of GPT-5.6 Sol, found two CVSS 9.2 vulnerabilities in the PHP engine and achieved unauthenticated remote code execution in affected deployments. The vulnerabilities, collectively called PHP2Shell, were found by Calif researchers participating in OpenAI's Patch the Planet program and involve, respectively, handling order during memory exhaustion and use-after-free; Wiz also independently discovered and reproduced the attack, and according to W3Techs, 69.3% of websites whose server-side language can be identified use PHP. PHP maintainers led the fix with OpenAI coordinating; coordinated disclosure was originally set for October 22, but the vulnerability IDs, an attack demonstration video and a fixed image leaked in succession in the final 48 hours, and the patch was released early on the 21st, covering PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

18. 06:21
    WeChat · Synced (Jiqizhixin)

    OpenAI model discovers major PHP security vulnerabilities, calls them one of the most impactful security issues in recent years

    OpenAI announced that its safety research team Calif used GPT-5.6 Sol to audit the PHP codebase and found two critical vulnerabilities allowing unauthenticated remote code execution (RCE); Google's Wiz independently discovered the same issues. On October 21, PHP urgently released four fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35; the vulnerabilities are collectively called "PHP2Shell," with a CVSS v4.0 score of 9.2, and affected versions range from 5.4 to 8.5. OpenAI said this may be one of the most impactful security issues in recent years, and proposed the concept of a "defender's window," referring to AI discovering vulnerabilities before attackers and buying time for fixes. Vulnerability information leaked the day before disclosure; Cloudflare said it had observed early signs of exploitation before the patch was released, and watchTowr said it had observed actual exploitation via honeypots on October 21. CISA and other national agencies urgently urged patching, the Wikimedia Foundation shut down a large number of services, and several Japanese games temporarily suspended service.

19. 05:02
    ELLIO

    PHP2Shell (CVE-2026-109618/109619): the first exploitation requests arrived 5.5 hours before PHP released fixes, and the scanning tool carries a Mirai-style loader

    On October 21, 2026, PHP released fixed versions for two CVSS 9.2 unauthenticated RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619, codenamed PHP2Shell); the ELLIO sensor captured the first exploitation requests 5.5 hours before the fixes were public, and by 21:00 UTC 31 addresses had sent 705 requests. Both vulnerabilities are triggered during PHP's request parsing stage, requiring no login or application-layer flaw; the fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and 8.1 and earlier have no official fix. Attack tools appeared in batches along with leaked materials, some carrying a Mirai-style loader, delivering a Mirai variant targeting 64-bit servers; the authors judge it to be of the same origin as the potassium family reported by Nokia Deepfield in May; this variant has 22 flooding methods and can attack Minecraft and FiveM servers, but has no self-propagation or persistence.

20. 05:00
    Shattered

    php2shell: AI-assisted discovery of PHP vulnerabilities affecting up to 70% of websites

    The PHP Foundation urgently disclosed two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, nicknamed php2shell) on October 21, 2026, and released fixes at the same time. According to reports, Calif discovered these vulnerabilities with the help of the AI model GPT-5.6 Sol, and the security company Wiz also independently discovered and reported the same batch of vulnerabilities; OpenAI, Google and Cloudflare were listed as response contributors. PHP reportedly supports up to 70% of websites and web applications, and of the 2.6 million hosts scanned by Censys, about 1.5 million were still running unpatched versions after the disclosure. The PHP Foundation urged immediate updates, and systems that cannot be patched in time should be temporarily taken offline; large-scale exploitation in the wild has not yet been confirmed. The article expects more disclosures to publicly credit AI-assisted discovery in the future.

21. 03:45
    The Decoder

    OpenAI GPT-5.6 Sol and Google Gemini 4 Argon discover severe PHP vulnerability affecting millions of websites

    OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon discovered a critical PHP vulnerability affecting millions of websites worldwide before attackers did, and a tool is already available on GitHub for server operators to check whether their PHP version is affected. GPT-5.6 Sol discovered the vulnerability under OpenAI's Patch-the-Planet program, and OpenAI says it is one of the most significant security issues of recent times; security firm Wiz also independently discovered the same vulnerability using its own Wiz Atlas platform combined with these two models, and says Gemini 4 Argon was particularly useful in finding the vulnerability, developing exploit code, building attack detection and validating patches. Wiz notes that large language models can automatically adapt exploit code to different PHP versions, configurations and memory layouts, significantly lowering the barrier to expanding attacks across deployment environments.

22. 03:10
    iThome (Taiwan)

    Wiz uses AI to find PHP2Shell, a PHP security vulnerability that has existed for over 10 years

    The PHP development team fixed two vulnerabilities codenamed PHP2Shell (CVE-2026-109618, CVE-2026-109619) on October 21, and Wiz, which reported the vulnerabilities, published the discovery process the same day. The vulnerabilities can be traced back to PHP 5.4, released in 2012. In late August, Wiz used top AI models such as Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to find the vulnerabilities, verified them on WordPress, Drupal, and Joomla, and received confirmation from PHP. Wiz said that manually verifying whether a vulnerability can actually be used in an attack was originally extremely difficult, and that top AI models greatly eliminated the related obstacles, turning long-standing software defects into exploitable security weaknesses, and called PHP2Shell the most severe vulnerability in PHP's history. Wiz emphasized that the vulnerabilities exist in PHP itself, so even running a Hello World application may leave users exposed; in addition to remote code execution, attackers can also read passwords, tokens, and API keys in process memory.

23. 01:59
    TechCrunch AI

    PHP doomsday: OpenAI and Google's Wiz find long-standing vulnerabilities, sending the internet into panic

    The US National Security Agency (NSA) warned on Wednesday that two critical vulnerabilities in PHP could allow attackers to compromise the server file system or the databases used by web applications. The PHP Foundation has released patches, and websites that cannot patch immediately should go offline first. The vulnerabilities have existed in all versions since PHP 5, released in 2004, and PHP powers about 70% of websites, or more than 33 million sites according to some counts; WordPress stated that the vulnerabilities are not specific to it, and that sites need to patch the server and coordinate with their hosting provider. The vulnerabilities were found by AI: security company Calif, participating in OpenAI's Patch the Planet program, used GPT-5.6 Sol to find one of them, while the Wiz team used the Wiz Atlas security AI agent, Gemini 4 Argon and GPT-5.6 Sol to find multiple vulnerabilities; both parties followed responsible disclosure and completed patch testing before public disclosure. Updating to the current version, PHP 8.5.12, is recommended; PHP 8.1 and earlier versions are no longer supported.

24. 00:59
    X @MinLiBuilds

    OpenAI coordinates disclosure of a critical PHP vulnerability found with AI assistance; the author warns that once the patch is public, attackers may quickly reverse-engineer it

    OpenAI announced that its models helped researchers discover a critical vulnerability in the open-source programming language PHP as part of the Patch the Planet initiative, and that it led a coalition to complete coordinated disclosure; the patch has been released, and websites using PHP can upgrade to the new version. PHP is estimated to support about 70% of websites. OpenAI said the fix took two months and required major changes to the PHP engine, and called it one of the most impactful vulnerabilities in recent years and an instance of the Defender's Window, in which frontier AI finds vulnerabilities before attackers do, giving defenders time to prepare. In the author's post, the two vulnerabilities are called PHP2Shell, each with a CVSS score of 9.2; government websites in multiple European countries have proactively gone offline to avoid risk, and the post warns that once the patch is public, attackers can compare the old and new versions and use AI to quickly reverse-engineer the vulnerability. The OpenAI announcement is at https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/

25. 00:43
    WeChat · QbitAI

    PHP discloses two ultra-high-severity vulnerabilities; OpenAI says GPT-5.6 Sol discovered them first

    PHP has disclosed two ultra-high-severity vulnerabilities with a severity score of 9.2 (CVE-2026-109618, CVE-2026-109619), collectively called PHP2Shell; in the most severe case, an attacker can execute code remotely without logging in, affecting almost all versions from PHP 5.4 onward. OpenAI's announcement states that the security company Calif discovered these vulnerabilities using GPT-5.6 Sol under its Patch the Planet open-source security initiative, and Wiz Research also independently discovered and reported them. Official fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been released; PHP 8.1 and earlier versions are no longer supported and have no patches available, and the official statement says the only safe approach is to upgrade immediately; researchers have reproduced unauthenticated remote code execution on some WordPress, Drupal and Joomla deployments, and according to Reuters, some government websites in the Netherlands, Finland and elsewhere have been taken offline in advance.

26. 00:12
    The Record

    Two PHP vulnerabilities raise concerns, hundreds of websites taken offline

    PHP issued an urgent advisory on Tuesday evening about two new vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with a severity score of 9.2/10, which can lead to remote code execution on unpatched websites; hundreds of websites went offline on Wednesday. The vulnerabilities are called PHP2Shell, and the EU, the US, Japan and other countries issued warnings, while companies such as Nintendo also took services offline; Cloudflare said it had already seen attacks appear and released temporary mitigations, and watchTowr said it had observed exploitation in the wild, with the exploit tool written with the help of AI. OpenAI said researchers at cybersecurity company Calif discovered the two vulnerabilities two months ago through its Patch the Planet project using its tools, and worked with PHP and other companies to test fixes and coordinate response, but acknowledged that AI can also help attackers exploit vulnerabilities.

1. 22:26
   WIRED Security and AI

   "This is not a drill": critical PHP vulnerabilities are plunging the internet into crisis

   The PHP Foundation released an emergency security update fixing two critical vulnerabilities with a CVSS score of 9.2, affecting all PHP installations that handle web requests since PHP 5. Vulnerabilities CVE-2026-109618 and CVE-2026-109619 could allow unauthenticated attackers to execute code or read process memory on affected servers, which may contain passwords, tokens, API keys and certificates. Cloudflare said it had seen early attacks before the update was released, Sansec expects large-scale attacks within 15 minutes of the fix's release, and some Finnish and French government websites and the Port of Rotterdam website were taken offline as a precaution. Only PHP 8.2 and newer versions are still supported and receive patches; the Foundation says there is no complete mitigation and updating is the only safe option. Wiz says its researchers found the vulnerabilities partly with the help of AI tools, and OpenAI and security firm Calif also said they independently discovered them and are collaborating, with the demo codenamed php2shell.

2. 22:00
   The Hacker News

   PHP releases emergency patches for two critical PHP2Shell remote code execution vulnerabilities; exploitation attempts already observed

   PHP released an emergency update fixing two critical vulnerabilities, collectively called PHP2Shell, that allow unauthenticated attackers to execute code on web servers, with a CVSS v4.0 score of 9.2. The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, affecting almost all versions dating back to PHP 5.4. The flaws are in the PHP runtime itself; servers using Apache mod_php are at highest risk, and a single unauthenticated request can trigger an attack before application code runs. The vulnerabilities were discovered by the Wiz, Calif and OpenAI Codex Security teams; researchers said AI models helped turn these flaws, which had existed for more than a decade, into working exploits, with one researcher completing in about a week work originally estimated to take a team months.

3. 21:59
   Wiz ResearchSelected

   PHP2Shell: AI finds critical RCE vulnerabilities affecting 70% of websites worldwide

   Wiz Research disclosed multiple critical memory-safety vulnerabilities in PHP core, classified as CVE-2026-109618 and CVE-2026-109619, with a maximum CVSS of 9.2, which can lead to unauthenticated remote code execution and disclosure of process memory information; PHP released patches on October 21, 2026. PHP powers 70% of websites worldwide, every version released in the past decade is affected by at least one vulnerability, the earliest dating back to PHP 5.4, and the vulnerabilities lie in PHP itself, unrelated to upper-layer applications. The team combined the vulnerabilities into the php2shell exploit script and demonstrated unauthenticated RCE on the latest container images of WordPress, Drupal and Joomla, and was able to read sensitive data such as passwords, authentication tokens and API keys in process memory. Wiz completed coordinated disclosure with the PHP team, Calif and OpenAI.

4. 21:56
   Cloudflare

   Cloudflare deploys protections against the php2shell vulnerability

   Cloudflare has deployed WAF protection against two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (collectively called php2shell), going live about 9 hours before public disclosure; free and paid WAF customers have been protected by default since 3:02 UTC on October 21. The vulnerabilities were disclosed by Calif.io, Wiz, OpenAI and Quarkslab, affect web servers running PHP 5.4 and above, and can lead to denial of service, remote code execution and data leakage; the root cause is a memory safety issue in PHP's error handling of HTTP requests. The vulnerabilities leaked before formal disclosure, and Cloudflare observed attack traffic targeting customers as well as attempts by attackers to vary payloads to bypass protections. Because the flaw is in the PHP runtime itself, updating only website code or plugins cannot fix it; administrators need to update the PHP software and keep WAF protection enabled.

5. 21:44
   WordPress

   Critical PHP Security Release
6. 21:40
   CyberScoop

   PHP urgently patches 2 critical vulnerabilities

   The PHP project urgently released patches on Wednesday to fix two remote code execution vulnerabilities with a CVSS v4.0 score of 9.2 (CVE-2026-109618, CVE-2026-109619), which researchers call php2shell. As of Wednesday afternoon there was no confirmed exploitation in the wild; CISA said it had not observed exploitation, and several security companies had only observed probing and reconnaissance targeting PHP applications. The vulnerabilities were discovered by the AI security company Calif using OpenAI's cybersecurity model GPT-5.6 Sol; OpenAI said Wiz also independently discovered and reported the vulnerability, and said frontier AI discovered the vulnerabilities before attackers, opening a preparation window for defenders. Wiz researchers said the vulnerability is a memory safety issue that has existed for decades and was previously difficult to exploit because exploit development was complex; AI lowered the cost of developing and adapting complex exploits, changing the economics of vulnerability discovery and exploitation.

7. 15:00
   OpenAISelected

   OpenAI Patch the Planet: global response coordination after agents discover high-severity vulnerabilities

   OpenAI said that in the Patch the Planet program, Calif used GPT-5.6 Sol to discover a high-severity vulnerability in PHP, Wiz also independently discovered and reported these two vulnerabilities, and PHP maintainers led the fix and release. OpenAI coordinated with partners including Wiz and Cloudflare as well as U.S. government agencies to prepare protections before disclosure, and proposed a five-stage response framework covering verifying and fixing upstream vulnerabilities, enabling affected organizations to prepare in advance, cooperating with governments, preparing product updates, and publishing deployment guidance. OpenAI also committed to providing $1 billion in subsidized access credits through Daybreak for Frontline Defenders, and expects similar high-severity discoveries to increase substantially in the coming months.

8. 10:12
   GMO Flatt Security Blog

   GMO Flatt Security published an overview of the PHP arbitrary code execution vulnerability php2shell (CVE-2026-109618/109619) and a corresponding guide, deliberately disclosing few details before the patch
9. Time not given
   HackerOne

   PHP critical vulnerabilities: what security teams should know

   PHP released fixes addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4, each of which can lead to unauthenticated remote code execution. The vulnerabilities are in the PHP runtime itself rather than in a specific application; web environments such as PHP-FPM and Apache mod_php are affected. Calif first discovered them, Wiz independently discovered them several weeks later, and OpenAI and others participated in coordinated disclosure.

10. Time not given
    SecurityWeek

    PHP2Shell vulnerability patches released, first exploitation attempts in the wild monitored

    PHP released patches fixing two critical vulnerabilities named PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2); both vulnerabilities have been confirmed to enable unauthenticated remote code execution on Apache mod_php, affect almost all versions dating back to PHP 5.4, and the patches are included in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. WatchTowr said it monitored the first exploitation attempts in the wild around the patch release but did not observe successful cases, and Hadrian said exploitation in the wild has reached scale and most attacks abuse PHP's session upload-progress path. The vulnerabilities were discovered in August by Wiz, OpenAI and Calif using frontier AI models and responsibly disclosed; the PHP Foundation said AI helped find more PHP vulnerabilities than before, and 15 new CVEs have been released since July 1.

11. Time not given
    The PHP Foundation

    PHP releases security updates, and how we are strengthening PHP security

    The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that under specific conditions could allow unauthenticated attackers to execute code remotely. CVE-2026-109618 comes from uninitialized data left behind when memory is exhausted, and CVE-2026-109619 comes from stale state pointing to the previous request's memory after a fatal error; both are in core paths such as memory management and error handling. The coordinated disclosure was leaked two days early, the CVE numbers circulated with an incorrect CVSS 10.0 (actual 9.2), and Chainguard released images containing the fix six hours before the coordinated release on October 21. The PHP Foundation said a 2024 external audit had found clues to the OOM issue, reports from Calif, OpenAI and Wiz in 2026 confirmed the full impact, and AI-assisted research has also increased the number of reports.

12. Time not given
    Semgrep

    PHP2Shell: two PHP runtime RCE vulnerabilities and how to fix them

    Two PHP runtime vulnerabilities, GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, can lead to remote code execution, and have been officially fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. GHSA-w8hw-w9fx-j79w exploits memory corruption caused by improper cleanup of failed requests during the request shutdown phase; under Apache with mod_php, merely exhausting request memory can trigger it before application code executes, so any PHP application that can receive web requests is affected; the authors say source analysis shows FPM, FrankenPHP and LSAPI may also be affected. The Semgrep research team used two open-weight models, relying only on public information and spending less than the cost of a cup of coffee, to reproduce RCE on stock PHP/Apache with PHP 8.4.26 and 8.5.11.

13. Time not given
    GIGAZINE

    Critical PHP vulnerability PHP2Shell was discovered by security companies Calif and Wiz using AI, with response measures implemented using OpenAI's framework

    Critical PHP vulnerability PHP2Shell (including two vulnerabilities, CVE-2026-109618 and CVE-2026-109619) was independently discovered by security companies Calif and Wiz using AI, and PHP released emergency updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35 late at night on October 21, 2026 Japan time. If exploited, attackers could take over servers, steal confidential data, or tamper with websites running on the servers. According to Calif, as part of OpenAI's Patch the Planet security program announced in June 2026, it discovered the first vulnerability on August 1, reported it to PHP on August 11, and discovered the second vulnerability on August 21; Wiz independently discovered it on August 19 and reported it on the 24th. Calif also released a demo video of the exploit executable on Nginx.

14. Time not given
    OpenAISelected

    Patch the Planet: OpenAI uses agents to discover major PHP vulnerabilities and lead a global coordinated response

    OpenAI announced that over the past two months, Calif in its Patch the Planet program used GPT-5.6 Sol to discover major PHP vulnerabilities; Wiz also independently discovered and reported these two vulnerabilities, and PHP maintainers led the completion of fixes and release. OpenAI, Wiz, Cloudflare and other partners coordinated preparations for defenses before vulnerability disclosure; OpenAI said frontier AI discovered these vulnerabilities before attackers, winning defenders a window to prepare fixes before disclosure. OpenAI has released the PHP version checker as a Codex skill, recommends that organizations using PHP prioritize applying the fixes, and committed to providing $1 billion in Daybreak usage funding through Daybreak for Frontline Defenders.

15. Time not given
    The Tribune

    AI-discovered PHP vulnerability triggers security emergency response; government websites in Europe and elsewhere taken offline

    PHP developers released an emergency fix on Wednesday for a long-latent critical vulnerability discovered with the help of AI; government websites in Europe and elsewhere were taken offline as a precaution, and website operators worldwide scrambled to respond. Tech companies warned that hackers are already exploiting these vulnerabilities, and because the fix is public and AI tools can easily reverse-engineer the vulnerability, experts are preparing for a wave of intrusions; Costin Raiu, co-founder of TLP:Black, said AI is driving an "exploitation race." PHP underpins a large number of websites including WordPress, Drupal, Joomla and Magento; Tiffany Farriss, interim CEO of the Drupal Association, said servers using any PHP version released in the past 20 years will be affected. Cybersecurity agencies in Europe, Australia, Japan and the UK urged users to update immediately or temporarily take websites offline; the Dutch cybersecurity agency took its own systems offline as a precaution, Wikipedia also took some systems offline pending patching, and Japanese Prime Minister Sanae Takaichi reminded website owners on X to check whether their live websites use PHP and to prepare to apply the new fix.

16. 04:25
    X @wunderwuzzi23

    php.net link posted on X with explosion emojis

    X user @ryanaraine posted a php.net link accompanied by 🧨🔥 emojis, and @wunderwuzzi23 responded, "It's not even Friday yet."

1. Date not given
   Associated Press

   Some websites temporarily taken offline as operators fix AI-discovered PHP vulnerabilities

   AI-assisted discovery of PHP vulnerabilities prompted European and American governments and other organizations to temporarily take websites offline on Wednesday to urgently install security updates. The FBI's cyber division warned that the vulnerabilities could allow malicious actors to execute code remotely in PHP, and advised operators unable to update immediately to take their websites offline; Finnish government websites were only partially available that day. The PHP Foundation has released fixes and update instructions. OpenAI said it led a coalition over the past two months with Wiz, Cloudflare and others to address these vulnerabilities, that PHP maintainers led the fix release, and that AI appeared to have found the vulnerabilities before attackers and that these vulnerabilities are among the most significant security issues recently; it expects similar discoveries to increase sharply in the coming months. Arctic Wolf researchers estimate that PHP accounts for about 70% of websites using known server-side programming languages, that some vulnerabilities have existed for more than a decade, and that what has changed is AI's ability to find weaknesses and turn them into usable attacks.

Current attention 61·Peak in the comparable period 90 (Oct 23 12:00)·Change over the comparable past 24 hours -5%