PHP2Shell: Emergency PHP Patches Fix Critical Flaws Found With AI Help
On Wednesday, PHP’s security team did something it almost never does. It shipped emergency patches for two critical flaws (CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell) that let an attacker run code on a web server without logging in first. The bugs are rated 9.2 out of 10 on the CVSS v4 severity scale, sit in the PHP language itself rather than any application, and one of them was found with the help of OpenAI’s models. ...