AI-Assisted Discovery of Critical PHP Vulnerabilities Underscores Urgency for Rapid Patching

Two critical remote code execution (RCE) vulnerabilities, collectively known as 'php2shell' (CVE-2026-109618 and CVE-2026-109619), have been disclosed in the core PHP language runtime. These flaws, rated 9.2 on the CVSS v4.0 scale, allow unauthenticated attackers to execute arbitrary code on web servers running vulnerable PHP installations. The vulnerabilities were discovered by security researchers from OpenAI, Wiz, and Calif, with significant assistance from advanced AI models like OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. The PHP Group has released emergency patches (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) and strongly urges immediate updates, especially for internet-facing systems. This disclosure is significant because it marks a clear inflection point in application security, showcasing the dual-edged sword of AI. While AI proved instrumental in identifying these long-standing, complex vulnerabilities that had existed in PHP for over a decade, it also means that threat actors can now leverage similar AI capabilities to accelerate exploit development. The sheer prevalence of PHP—powering up to 70% of websites—means the attack surface is enormous, affecting a vast array of web applications and services. Organizations that rely on PHP for their web infrastructure, content management systems, or custom applications are directly impacted and face an immediate and severe risk if they do not patch promptly. The CISA has issued an alert strongly urging organizations to immediately patch, and to take PHP-based systems offline if immediate patching is not possible, especially for unsupported versions. This event fits into the broader trend of AI's increasing role in cybersecurity, both as a defensive tool and an offensive weapon. For months, the cybersecurity community has been racing to utilize AI for bug discovery and automated remediation. However, the rapid proliferation of capable AI models, including those becoming freely available, means that the advantage gained by defenders through AI-assisted discovery can quickly be neutralized by attackers using AI for exploitation. This accelerates the 'patch or perish' cycle, demanding even greater agility and automation in security operations. The incident also highlights the ongoing challenges in software supply chain security, as a fundamental component like PHP can harbor critical flaws for extended periods, impacting downstream applications. In practice, practitioners must prioritize an immediate and comprehensive patching effort across all PHP installations. This includes identifying and inventorying all systems running PHP, as it can be an embedded component in various software stacks. For organizations unable to update immediately, implementing Web Application Firewalls (WAFs) can offer some temporary protection, though it's not a substitute for patching. Furthermore, this incident should serve as a wake-up call for organizations to invest more heavily in AI-driven security tools for proactive threat hunting and vulnerability management. It also underscores the importance of a robust DevSecOps culture, where security is integrated early and continuously throughout the development lifecycle, enabling faster response to critical vulnerabilities. The 'Defender's Window'—the time between vulnerability discovery and widespread exploitation—is shrinking, making rapid, automated response capabilities more critical than ever. Organizations should also consider the implications for their end-of-life PHP versions, as these will not receive official patches and present a significant ongoing risk.