# AI Finds Critical PHP Bugs, Triggering Global Cybersecurity Rush

> Two severe remote code execution vulnerabilities, collectively called PHP2Shell, were discovered by security firms using advanced AI models, leading to a global scramble to patch websites before widespread exploitation.

By PrimaryBrief newsroom · Published 2026-10-25T05:11:16.573125Z
Canonical: https://primarybrief.com/article/ai-finds-critical-php-bugs-triggering-global-cybersecurity-rush-3e95ec1a

Security firms Calif and Wiz, using advanced AI models, uncovered two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP programming language which powers approximately 70% of the world's websites [1][15][16]. These flaws, rated with high severity scores of 9.2 to 10.0, enable attackers to execute malicious code remotely without authentication [1][6]. The discovery prompted a global cybersecurity alert and a rapid push for patches, especially after Amazon Threat Intelligence detected exploitation attempts four days before official fixes became available [3][4].

This incident shows how AI is reshaping vulnerability research, both by accelerating discovery and potentially increasing the speed of exploitation. The widespread use of PHP means these vulnerabilities could affect millions of websites, from government portals to e-commerce platforms, making swift patching essential for internet security [15][16][17].

## AI-Driven Discovery

Calif and Wiz independently found the PHP2Shell vulnerabilities, attributing their findings to advanced Artificial Intelligence models [1][6]. In August 2026, Ryan Austin, a security researcher at Calif, used OpenAI's GPT-5.6 Sol model as part of OpenAI's "Patch the Planet" initiative to develop a pre-authentication RCE exploit chain from a theoretical Out-of-Memory (OOM) condition [7]. Simultaneously, Wiz reported both CVEs, employing AI-driven vulnerability research agents powered by Google Gemini and GPT models, along with their proprietary tool, Wiz Atlas [7]. These firms indicated that AI allowed researchers to complete work in hours that previously would have taken months [8].

## Exploitation Before Patches

The public announcement of the PHP2Shell flaws occurred on October 20, 2026, with security patches released the next day, October 21, 2026 [1]. However, Amazon Threat Intelligence reported identifying an exploitation attempt of the PHP2Shell vulnerabilities in their MadPot honeypot telemetry on October 17, 2026, four days before the official patches were available [3][9][10]. This attempt originated from an IP address linked to a commercial anonymization network, suggesting a threat actor was involved [9]. While researchers noted that not every observed attempt successfully compromised a real-world server, these early attempts indicated that details were circulating before the planned public disclosure [11][14]. Check Point Research estimated that 10% of organizations worldwide experienced exploitation attempts [14].

## Global Response

The incident led to a "hectic 72-hour rush" among cybersecurity agencies globally [4]. Leaked vulnerability details contributed to a surge in exploitation attempts [2][4]. As a precaution, several government and company websites, including some in the Netherlands and Finland, were temporarily taken offline to apply updates [8][13][14]. The National Security Agency urged organizations using PHP to update their systems or take them offline if an update was not immediately possible [8].

## Key Contributor in Rapid Fixes

Ondřej Surý, Director of DNS Engineering at the nonprofit Internet Systems Consortium, played a significant role in enabling rapid deployment of fixes [5][18]. Surý, who volunteers his time to build ready-to-use packages from PHP source code, quickly created packages for Debian and Ubuntu, including backported fixes, to help administrators update thousands of servers efficiently [18][19]. His repositories carried updated PHP versions and backports, making patches accessible for a wide range of systems [19].

## What We Could Not Confirm

We could not confirm how the threat actor obtained exploit information prior to the official disclosure of the PHP2Shell vulnerabilities [9]. The extent to which these early exploitation attempts successfully compromised real-world servers before patches were widely applied also remains unconfirmed [11]. We also could not confirm the exact number of unique internet-facing PHP servers successfully patched versus those remaining vulnerable since disclosure [17].

## Evidence cited
1. News Wrap: Cybersecurity threat prompts scramble to protect websites around the world (www.pbs.org) — https://www.pbs.org/newshour/show/news-wrap-cybersecurity-threat-prompts-scramble-to-protect-websites-around-the-world
2. The AI-Discovered Bug That Could Have Become a Cybersecurity Disaster (time.com) — https://time.com/article/2026/10/23/ai-cybersecurity-php-hack/
3. Amazon says PHP2Shell exploitation began 4 days before patches (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches/
4. Inside the cyber flaw scramble that brought the AI threat to life (www.politico.eu) — https://www.politico.eu/article/the-cyber-flaw-scramble-that-brought-the-ai-threat-to-life/?utm_source=RSS_Feed&utm_medium=RSS&utm_campaign=RSS_Syndication
5. ‘If Anything Happens to This Guy … Everyone Is Screwed’ (www.theatlantic.com) — https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/?utm_source=feed
6. php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities (tenable.com) — https://tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php
7. PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web (aws.com) — https://aws.com/blogs/security/php2shell-how-ai-found-a-decade-old-bug-in-70-percent-of-the-web/
8. Global websites shut down after AI found a critical flaw affecting 70% of the internet - CNN (cnn.com) — https://www.cnn.com/2026/10/21/tech/ai-php-vulnerabilities-cybersecurity-wrap/index.html
9. PHP2Shell Exploitation Began 4 Days Before Public Disclosure, Amazon Says (thehackernews.com) — https://www.thehackernews.com/2026/10/php2shell-exploitation-began-4-days.html
10. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (amazon.com) — https://amazon.com/security/aws-security-blog/2026/10/21/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure/
11. PHP2Shell: CVE-2026-109618 and CVE-2026-109619 : r/PHP (reddit.com) — https://www.reddit.com/r/PHP/comments/16g4z3o/php2shell_cve2026109618_and_cve2026109619/
12. PHP2Shell - Wikipedia (en.wikipedia.org) — https://en.wikipedia.org/wiki/PHP2Shell
13. PHP2Shell: Critical Flaws in Software Powering 70% of Websites Cause Worldwide Disruption - Coeus.us (coe.us) — https://coe.us/news/php2shell-critical-flaws-in-software-powering-70-of-websites-cause-worldwide-disruption/
14. Check Point Research finds critical PHP vulnerabilities dubbed PHP2Shell are being actively exploited globally (checkpoint.com) — https://www.checkpoint.com/press/2026/check-point-research-finds-critical-php-vulnerabilities-dubbed-php2shell-are-being-actively-exploited-globally/
15. PHP2Shell: Cybersecurity experts warn of "extremely serious" bug in websites (cbsnews.com) — https://www.cbsnews.com/news/php2shell-php-bug-websites-vulnerability-cybersecurity/
16. PHP2Shell: Critical Vulnerabilities Expose PHP Servers to RCE | Harness (harness.io) — https://harness.io/blog/php2shell-vulnerabilities-rce
17. PHP2Shell: Everything you need to know - Shattered.io (shattered.io) — https://shattered.io/php2shell-everything-you-need-to-know/
18. How Ondřej Surý saved the internet (bluewin.ch) — https://www.bluewin.ch/en/digital/news/2026/10/24/how-ondrej-sury-saved-the-internet.html
19. PHP2Shell fixed versions: Ondřej Surý, Remi (eseospace.com) — https://www.eseospace.com/php2shell-fixed-versions-ondrej-sury-remi/
20. The PHP2Shell Story & The Man Who Keeps PHP Running - HeroDevs (herodevs.com) — https://herodevs.com/blog/php2shell-story-the-man-who-keeps-php-running
21. PHP2Shell: Critical Vulnerabilities in PHP (ddev.com) — https://ddev.com/blog/php2shell/
22. PHP2Shell: Critical PHP RCE vulnerabilities are being exploited now (aikido.dev) — https://aikido.dev/blog/php2shell-critical-php-rce-vulnerabilities
23. Critical PHP “PHP2Shell” RCE Vulnerabilities Allow Unauthenticated Remote Code Execution (CVSS 9.2) (orca.security) — https://orca.security/resources/blog/php2shell-critical-php-rce-vulnerabilities/
24. PHP2Shell vulnerabilities and patch information - Sansec (sansec.io) — https://sansec.io/research/php2shell-vulnerabilities
25. PHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated RCE in PHP. See fixed versions, Qualys exposure data, QIDs, and how to mitigate before you patch (qualys.com) — https://qualys.com/blog/php2shell-cve-2026-109618-cve-2026-109619-unauthenticated-rce-in-php/
26. PHP2Shell Critical RCE Vulnerabilities Explained (2026-2027): How to Check and Patch - OpsMx (opsmx.com) — https://opsmx.com/php2shell-critical-rce-vulnerabilities-explained-2026-2027-how-to-check-and-patch/
27. PHP2Shell Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): Global Security Scramble (servermo.com) — https://servermo.com/article/php2shell-vulnerabilities-cve-2026-109618-cve-2026-109619-global-security-scramble/
28. PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web - DEV Community (dev.to) — https://dev.to/aws-heroes/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-percent-of-the-web-1f5k
29. PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web - CodingCat.dev (codingcat.dev) — https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble/