ME News reports that on October 22 (UTC+8), according to media outlets such as BBC and IT Home, PHP has been found to contain two critical security vulnerabilities, collectively named PHP2Shell, with CVE IDs CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2. Attackers can remotely execute code without authentication. PHP is an open-source programming language that powers approximately 70% of websites worldwide; if exploited, these vulnerabilities could allow attackers to alter website content, steal sensitive data, or take full control of servers.
Both vulnerabilities were discovered by AI. The security company Calif identified one vulnerability using OpenAI’s GPT-5.6 Sol model, while Wiz, a security company under Google, independently discovered and reported the related vulnerability. Wiz stated that this is the most severe vulnerability ever found by AI. OpenAI said the discovery was part of its "Patch the Planet" initiative, and the involved parties coordinated a fix for approximately two months prior to public disclosure.
Due to the premature leak of vulnerability information, the PHP Foundation brought forward the originally scheduled October 22 patch to October 21 at 22:00 Beijing Time, releasing fixed versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Several countries immediately took emergency measures: the Netherlands took down its digital identity system and parliamentary websites, Finland suspended certain government services, Japan’s niconico and pixiv entered emergency maintenance, and Japanese Prime Minister Hayashi Fumio publicly urged all parties to promptly verify and apply the patches. The U.S. National Security Agency’s (NSA) cybersecurity division advised organizations unable to update immediately to take their systems offline until the risk is fully mitigated. (Source: ME News)
