PHP2Shell Exploitation Confirmed in Wild After AI-Assisted Discovery

Key points

• Two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were patched by the PHP security team on October 21, 2026.
• Adel Karimi of Perplexity confirmed successful in-the-wild exploitation against an Apache mod_php installation running PHP 8.4.26, noting usable memory disclosure.
• The vulnerabilities stem from memory-safety issues in PHP's handling of fatal errors and upload-progress handling, allowing unauthenticated attackers to execute code or steal sensitive data.
• Wiz Research, assisted by AI models like Gemini 4 Argon and GPT-5.6 Sol, discovered the flaws in August 2026, demonstrating that AI reduced the time to develop exploits from months to weeks.
• Multiple cybersecurity firms, including Cloudflare and Amazon, detected exploitation attempts before public disclosure, though many were initially unsuccessful until the confirmed wild exploitation.

Background

This incident follows a broader trend of AI-assisted vulnerability discovery, as seen in earlier breaches involving OpenAI and Anthropic tools. It also aligns with the 'Black October' cybersecurity crisis mentioned in recent reports, where multiple critical software flaws were disclosed simultaneously. Previous coverage noted that AI has enabled attackers to create more sophisticated phishing attacks and exploit long-standing vulnerabilities that were previously impractical to exploit manually.

How outlets are covering it

BleepingComputer and Wiz emphasize the technical confirmation of exploitation and the role of AI in lowering the barrier to exploit development. CNN focuses on the broader implications for internet infrastructure and advises users to update software and practice good security hygiene. The Atlantic highlights the systemic fragility of the internet, noting that this incident is part of a larger wave of breaches affecting major companies and government services. Wiz specifically credits AI models for enabling a single researcher to achieve what previously required a large team, while BleepingComputer notes that earlier exploitation attempts were largely unsuccessful until the confirmed wild exploitation.

Why it matters

PHP powers a significant portion of the internet, making these vulnerabilities highly impactful. The successful exploitation in the wild demonstrates that AI can turn long-standing, complex vulnerabilities into immediate threats. Organizations must prioritize patching and monitoring for unusual activity, as the barrier to exploitation has decreased significantly due to AI advancements.

What to watch

Organizations should immediately apply the PHP security patches released on October 21, 2026. Administrators should also implement mitigation measures for the new RCE vulnerability CVE-2026-115560, such as setting session.upload_progress.enabled=0. Continuous monitoring for unusual multipart requests and memory-limit errors is advised. The cybersecurity industry is expected to see more AI-assisted vulnerability disclosures in the coming months.