← Back to Briefing
Critical PHP Vulnerabilities (PHP2Shell) Discovered by AI and Actively Exploited Globally
Importance: 95/10016 Sources
Why It Matters
This event signifies a significant shift in cybersecurity, where advanced AI tools are now capable of uncovering widespread, critical vulnerabilities. The pre-patch exploitation and rapid global impact underscore the urgent need for robust security postures and faster patch deployment, as AI-driven discovery could accelerate future attack cycles.
Key Intelligence
- ■AI models have uncovered two critical Remote Code Execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619), dubbed "PHP2Shell," impacting up to 70% of the internet.
- ■Hackers began exploiting these flaws days before they were publicly known or patched, with Amazon Web Services (AWS) logging early attempts.
- ■The vulnerabilities are now being broadly exploited, leading to widespread website shutdowns, including banks and airlines in Japan, as organizations rush to apply patches.
- ■The incident highlights a new cybersecurity challenge where AI can discover critical flaws faster than developers can fix them, indicating a potentially more disruptive era for internet security.
- ■Global efforts are underway to update systems and mitigate the risks posed by these actively exploited, foundational web code flaws.
Source Coverage
Wired.com
10/22/2026Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
Google News - Foundation Models
10/21/2026AI Helped Find a Critical Bug Affecting Huge Swathes of the Internet - Mother Jones
Google News - AI & Models
10/21/2026AI uncovers massive flaw in web's foundational code - Axios
Google News - AI & Models
10/22/2026Websites go dark as AI exposes critical security flaws - AFP.com
Google News - AI & Models
10/21/2026PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet - wiz.io
Google News - AI & Models
10/21/2026PHP Patches Two Critical RCE Flaws Found with Frontier AI Models - Unite.AI
Google News - AI & Models
10/21/2026AI helped discover the PHP vulnerability that could take down 70% of the internet - Fortune
Google News - Foundation Models
10/21/2026Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 - Google
Google News - AI & Bloomberg
10/22/2026Japan Scrambles to Patch PHP Flaws as Banks, Airlines Go Offline - Bloomberg.com
Google News - AI & Models
10/22/2026Some websites shut down globally as operators address PHP issue after AI finds critical flaw - ABC7 New York
Google News - AI
10/22/2026Global race to update computers as AI discovers most disruptive hack yet - New Scientist
Google News - AI & Models
10/22/2026Some websites shut down globally as operators address PHP issue after AI finds critical flaw - ABC7 Chicago
Google News - AI & Bloomberg
10/22/2026How AI Unearthed PHP Software Flaws That Put Millions of Websites at Risk - Bloomberg.com
Google News - AI & Bloomberg
10/22/2026Researchers Say Hackers Targeted PHP Before Flaws Were Known - Bloomberg.com
Google News - AI
10/22/2026PHP’s security scramble is just a preview: AI is digging up flaws faster than maintainers can fix them - The New Stack
Google News - AI & Models
10/22/2026