[FLASH] PHP ships emergency patches for PHP2Shell RCE flaws found by Calif, OpenAI and Wiz; early attacks seen
The PHP project released emergency fixes (8.5.12, 8.4.27, 8.3.36, 8.2.35) for two critical unauthenticated remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Researchers from Calif, OpenAI and Wiz reported the bugs. Wiz said frontier AI models 'substantially reduced' the barrier to turning a long-standing flaw into a working exploit. BleepingComputer reported Cloudflare already seeing early attack attempts and the UK NCSC telling organizations to patch or take systems offline. This is a concrete case of AI-accelerated vulnerability discovery reaching mass-deployed infrastructure, the remediation-spend theme the desk tracks across cyber names. Next to watch: confirmed in-the-wild compromises and how fast patches are adopted.