PHP2Shell was only the beginning: AI is accelerating the patch race
Covered by 4 sources
Read the full article
Two critical PHP vulnerabilities dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) caused widespread shutdowns of government and public websites across Europe as organizations awaited patches. The PHP project released fixes on October 21, but many users remain on unsupported versions, raising ongoing security concerns amid accelerated vulnerability discovery driven by AI.
Covered by 4 sources
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking· The Hacker News
- AI is finding software flaws faster, and so are hackers: Inside the PHP scramble· 2 sources
- Hackers got a four-day head start on epic PHP2Shell vulnerability· Ars Technica
- AI found a critical PHP flaw. The bigger failure began in 2024.· The New Stack (AI)
- Millions of PHP2Shell attempts so far, but officials see no break-in· The Next Web
- PHP knew about one of the flaws in 2024 but could not agree a fix· The Next Web
