A pair of critical vulnerabilities in PHP has triggered a global cybersecurity response after researchers demonstrated that attackers could potentially execute code remotely on vulnerable servers without authentication.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, received severity scores of 9.2 from the PHP project.
PHP is embedded throughout web infrastructure, including systems supporting WordPress, Drupal and Joomla installations as well as government and corporate services.
Researchers discovered the vulnerabilities with substantial assistance from advanced artificial-intelligence systems.
Security researchers at Calif and Wiz independently identified weaknesses that had remained in PHP’s code for years. Wiz said AI systems helped perform analysis and exploit-development work that previously would have been extremely difficult to scale manually.
The disclosure triggered immediate operational consequences.
Government websites and other services in several European countries were temporarily taken offline while administrators patched systems or evaluated their exposure.
PHP developers released emergency updates covering supported PHP branches and urged users to upgrade immediately.
Evidence also emerged that attackers had begun probing the vulnerabilities before their scheduled public disclosure.
Amazon security chief CJ Moses said the company’s MadPot honeypot infrastructure recorded an attempted exploitation on October 17 — four days before the vulnerabilities were publicly disclosed.
Amazon later said PHP2Shell was being broadly exploited in the wild.
The episode illustrates a potentially important shift in cybersecurity economics.
Artificial intelligence can accelerate defensive vulnerability research, allowing researchers to uncover weaknesses that have survived conventional code review for years.
The same capability can also compress the time attackers need to understand a disclosed vulnerability and construct working exploits.
That reduces the traditional window between disclosure, patching and large-scale attacks.
For businesses, the exposure extends beyond websites themselves. PHP can be embedded in applications, management interfaces and other systems that administrators may not immediately recognize as PHP-dependent.
The immediate priority across the industry remains patching supported PHP versions and identifying legacy installations that cannot receive security updates.
The broader market implication is more structural: AI is increasing the speed of both vulnerability discovery and exploitation, forcing cybersecurity vendors, cloud providers and software maintainers to operate on increasingly compressed response timelines.
