PHP2Shell: AI finds critical RCE in PHP
| Source: HN | Original article
AI tools have identified a critical remote code execution vulnerability in PHP, dubbed PHP2Shell.
AI‑driven research has uncovered a pair of critical remote‑code‑execution (RCE) flaws in the core of PHP, the scripting language that powers roughly 70 % of all websites. The vulnerabilities, catalogued as CVE‑2026‑109618 and CVE‑2026‑109619, received a CVSS severity rating of 9.2. Researchers combined the two bugs into an exploit dubbed “php2shell,” demonstrating unauthenticated code execution against popular platforms such as WordPress, Drupal and Joomla within hours. Frontier AI models – notably Gemini 4 Argon and GPT‑5.6 Sol – were used to adapt the exploit across multiple applications, highlighting how generative AI can accelerate the weaponisation of software bugs.
The PHP development team issued emergency patches on 21 October 2026, covering all supported PHP versions from 5.4 onward. The rapid disclosure underscores the systemic risk posed by a language that underpins the majority of the web. Successful exploitation could let attackers seize control of servers, exfiltrate data and deface sites, potentially affecting millions of online services worldwide.
Stakeholders are now watching how quickly hosting providers, content‑management‑system maintainers and site owners apply the patches. Security teams are also assessing whether any pre‑patched attacks have already been observed in the wild. The episode raises broader questions about the role of AI in both discovering and exploiting software vulnerabilities, and whether defensive tooling can keep pace with AI‑augmented threat actors. Future developments to monitor include any follow‑up advisories from the PHP Foundation, reports of active exploitation, and the emergence of AI‑assisted vulnerability‑scanning tools that could surface similar high‑impact bugs in other critical software stacks.
Sources
Back to AIPULSEN