AI found a critical PHP flaw. The bigger failure began in 2024.
The New Stack (AI)
Read the full articleTwo critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were discovered and patched after AI-assisted researchers found remote code execution flaws. The incident highlights challenges in coordinated disclosure and the growing role of AI in security research.
- AI is finding software flaws faster, and so are hackers: Inside the PHP scramble· 2 sources
- Hackers got a four-day head start on epic PHP2Shell vulnerability· Ars Technica
- Millions of PHP2Shell attempts so far, but officials see no break-in· The Next Web
- PHP2Shell was only the beginning: AI is accelerating the patch race· 4 sources
- PHP knew about one of the flaws in 2024 but could not agree a fix· The Next Web
