PHP2Shell was only the beginning: AI is accelerating the patch race
The New Stack Matthew Weier O’Phinney ● Covered by 15 sources
Europe pulled government sites offline after two PHP flaws surfaced. The scary part: AI is making serious bugs easier to find, faster than patching can keep up.
Based on reporting by The New Stack, Matthew Weier O’Phinney — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Government websites across Europe went dark this week after organizations reacted to two newly disclosed PHP vulnerabilities. Germany took several federal sites offline. France temporarily shut down prefecture sites. Belgium’s foreign ministry disabled its own websites, and organizations in the Netherlands pulled public-facing services as a precaution. The same scramble played out well beyond Europe, as companies and public bodies waited for a mitigation that didn’t exist yet.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, can lead to remote code execution when out-of-memory conditions and PHP’s error handling line up badly enough. They affect every PHP version back to 5.4 in at least one case, and the problem sits in PHP itself rather than in a single app or framework. That matters because there is no real workaround at the application layer. Wiz Research said attackers could use the bug to run code remotely or pull sensitive data from memory, including passwords, authentication tokens, API keys, and certificates.
Datadog Security Labs independently reproduced the issue and found that application authentication does not stop it. The malicious request is handled by PHP before app code even gets a chance to look at it. In one reproduction of CVE-2026-109618, the request never reached the target application’s code at all. So even teams with decent app security hygiene were exposed if the runtime itself was vulnerable.
The PHP project moved quickly once the full impact became clear in August. The PHP Ecosystem Security Team, the PHP Foundation, release managers, and LTS vendors including Zend coordinated fixes across all supported versions, with patches released on the morning of October 21. Even so, the ugly part is still hanging over the ecosystem: an estimated 40% of PHP users are on unsupported PHP, which means they’re leaning on backports and vendor fixes, or sitting in a riskier place than they may realize.
The bigger story is how AI changes the economics of vulnerability research. OpenAI says one critical PHP flaw was identified through its Patch the Planet effort using GPT-5.6 Sol, and it expects more findings to rise sharply in the coming months. That pushes the industry into a nastier race: discover faster, patch faster, and keep up with a flood that is only getting easier to generate.
My take — AI-written commentary, not fact-checked reporting
The comforting line that “open source is more secure because more eyes” just got a fresh bruise. Better discovery is nice; pretending response systems will magically scale with it is the usual tech-world fairy tale. The real test now is whether teams can stop treating unsupported software like a temporary inconvenience and start treating it like what it is: borrowed time.
Read more about this at: The New Stack