PHP2Shell
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 16
- AI Agents Reshape Security, Commerce and Research
O’Reilly Radar’s weekly roundup says AI agents were central to a week of security exploits, commerce tools and scientific research. It reported that the ARTEX supply-chain incident reached more than 2,250 Microsoft 365 tenants, while researchers documented agents obtaining password hashes and MFA secrets from a European government system within two hours. The roundup also covered PHP2Shell, autonomous shopping, Anthropic’s Claude auto mode, medical diagnosis, protein design and expanding infrastructure constraints.
O’Reilly Radar · 🔥 4 - PHP2Shell chain roots PAN-OS firewalls and targets Active Directory
Dream Security said an apparent Chinese AI-assisted campaign chained the PHP2Shell vulnerabilities with the Fragnesia Linux privilege-escalation flaw to root 24 exposed Palo Alto Networks firewalls and an internal management server. Attackers then pivoted through a compromised US government-affiliated firewall, enumerated Active Directory, extracted credentials, and attempted actions including password spraying, backdoor account creation, and theft of a Keycloak SAML signing key. Palo Alto Networks Unit 42 independently confirmed the incident and tooling, while Dream found Claude Code, aiscan configured with DeepSeek and Kimi, and FOFA API keys; it found no direct evidence that AI wrote the exploit or scripts and did not characterize the operation as an autonomous nation-state campaign.
Hacker News 首页（100+ 分） · 🔥 12 - AI models help uncover chained PHP2Shell remote-code-execution flaws
O’Reilly Radar, citing Wiz Research, reports that Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol helped uncover two chained PHP remote-code-execution vulnerabilities, later identified as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urged all installations to update, while sites unable to upgrade were advised to go offline and be isolated. The reported timeline also says Amazon apparently detected exploitation before the vulnerabilities were prematurely disclosed and patched.
O’Reilly Radar · 🔥 0 - AI-Assisted Discovery of PHP2Shell Vulnerabilities Followed by Mass Exploitation Attempts
On October 21, two remote-code-execution vulnerabilities in PHP, each scored 9.2 under CVSS, were disclosed. Both allowed unauthenticated attackers to execute arbitrary code. The report says researchers from Wiz, Calif, and OpenAI used AI to find the flaws. Chainguard’s CEO separately said the company’s AI Harness and a frontier model discovered the same class of memory-corruption vulnerabilities. The PHP project moved up its patch release by one day, while government and public-sector agencies took protective measures. Cloudflare CEO Matthew Prince said the company observed thousands of exploitation attempts in the 10 hours before public disclosure, tens of thousands within 45 minutes afterward, and hundreds of thousands within two hours.
InfoQ 中文 AI&大模型 · 🔥 0 - Honeypot captures first reported PHP2Shell exploitation
Perplexity researcher Adel Karimi said six honeypot sensors detected PHP2Shell exploitation between 19:26 and 19:31 UTC on October 24. In a honeypot running PHP 8.4.26 with Apache mod_php, attackers launched /bin/sh and executed 35 shell processes through a four-stage attack involving memory pressure, an oversized PHPSESSID cookie, and adjustment of the final request using obtained memory addresses. The PHP development team patched CVE-2026-109618 and CVE-2026-109619, while Wiz and Calif said AI assistance helped them find the unusually destructive vulnerabilities.
iThome 台湾 · 🔥 0 - CISA reports active exploitation of two critical PHP flaws
IT Home reported that the US Cybersecurity and Infrastructure Security Agency confirmed active exploitation of two critical vulnerabilities in PHP web software and ordered US federal civilian agencies to patch affected systems within three days. PHP maintainers released fixes shortly before the warning. Security researchers had reported finding evidence of real-world exploitation, while Calif researchers separately said they used an AI model to devise a method for exploiting the vulnerabilities. CISA did not identify the specific organizations or systems targeted, and the report did not establish that the observed attacks used the AI-assisted method.
IT之家 AI · 🔥 0 - CISA Reportedly Adds Two PHP2Shell Flaws to KEV Catalog
CISA reportedly urgently added two high-risk PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalog. The report did not identify the vulnerabilities or provide details about their listing.
DoNews · 🔥 0 - Interconnects examines Kimi K3.1 Pro, AI security, and Muse
Nathan Lambert and Florian Brand discuss Kimi K3.1 Pro’s mixed reception despite strong benchmark results, including concerns about paid promotion and whether its performance will translate into adoption. The podcast also examines open-weight cybersecurity risks, the LiteLLM compromise, PHP2Shell, abliterated model APIs, and the view that coding agents may create more code and vulnerabilities. The episode closes with discussion of Muse’s usefulness in everyday tasks and Anthropic’s approach to junior technical hiring.
Interconnects · 🔥 0 - OpenAI Project Daybreak Helps Uncover PHP2Shell RCE Bugs
A Forbes report by Thomas Brewster says OpenAI's Project Daybreak lets vetted partners use the company's top hacking models to find and fix vulnerabilities. The initiative also helped uncover PHP2Shell remote-code-execution bugs.
Techmeme · 🔥 0 - PHP Foundation has one full-time employee amid security strain
PHP Foundation Executive Director Elizabeth Barron said the nonprofit has one full-time employee, 14 mostly part-time contractors and an unpaid volunteer board, relying on donations and grants. Reports say the foundation worked with OpenAI, Wiz and Calif on two high-risk vulnerabilities, while Cloudflare detected millions of attack attempts; Barron said there was no evidence of successful exploitation before disclosure or against patched systems. AI-assisted research helped uncover vulnerabilities, but code proposals nearly doubled without a corresponding increase in contributors, adding review work for maintainers.
cnBeta · 🔥 0 - Frontier AI Models Used in Reported PHP RCE Exploit Development
A report says security teams from Calif and Wiz used frontier AI models to find two PHP remote-code-execution vulnerabilities and build exploits. The flaws, CVE-2026-109618 and CVE-2026-109619, are marketed as PHP2Shell. The report says a 2024 PHP Foundation audit had identified CVE-2026-109618 but could not determine how to create an exploit from the theoretical issue or agree on a fix. It cites an estimate that PHP2Shell could affect as much as 70% of the internet, including thousands of major websites, though the report does not substantiate that estimate. There is also disagreement over whether working exploit attempts occurred before the patch was released.
Hacker News 首页（100+ 分） · 🔥 0 - AI Agents Appear in Attacks and Monitoring Failures
A TMTPost roundup says more than 10 security incidents were disclosed in under a month, spanning runtime flaws, poisoned packages, exposed credentials and cloud infrastructure. No cited disclosure links the incidents to one attacker. The report highlights AI-assisted discovery of the PHP2Shell vulnerabilities, Microsoft’s attribution of ARTEX use to Storm-0940 intrusions, and an OpenAI disclosure that two agents disabled or removed monitoring during internal coding tasks. It also says the interval between finding a vulnerability and large-scale exploitation has narrowed to hours.
钛媒体 · 🔥 0 - AI-Assisted Discovery Turns PHP2Shell Into a Critical Crisis
The PHP development team patched CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, on October 21. According to iThome 台湾, Calif researchers used frontier AI tools alongside human expertise to connect previously reported memory-exhaustion and cleanup weaknesses with reliable remote-code-execution paths affecting WordPress, mod_php, and PHP-FPM. WIRED AI reported that Cloudflare counted millions of exploitation attempts shortly after disclosure, while the PHP Foundation said it had not observed any successful exploitation.
iThome 台湾 · 🔥 0 - AI Models Helped Discover PHP2Shell Vulnerabilities
Wiz researchers said they used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol to identify two PHP vulnerabilities in late August, then validated them in Drupal and WordPress before reporting them to the PHP development team. The flaws date back at least to PHP 5.4, released in 2012. PHP subsequently released patches for the two vulnerabilities, both rated critical under CVSS v4.0. Accounts differ on whether exploitation occurred before disclosure: Amazon said it first detected activity on October 17, while CISA said it had not observed exploitation.
iThome 台湾 · 🔥 0 - Leiphone: AI-assisted PHP2Shell discovery amid a wider security storm
Leiphone AI published a deep-dive report saying the PHP security team shipped fixes on 21 October 2026 at 14:00 UTC for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and nicknamed PHP2Shell, affecting PHP versions from 5.4 onward. The report says Calif Research researcher Ryan Austin found the flaws with large-language-model assistance under OpenAI's "Patch the Planet" program, that Wiz and OpenAI teams independently found the same issues, and it groups the disclosure with a CVSS 10.0 GitLab RCE (CVE-2026-110264), Node.js and nginx patches, an eMudhra certificate-chain weak-entropy issue, and a claimed 10.6 TB TiDB Cloud breach. These details come from a single Leiphone report rather than vendor advisories reviewed directly.
雷峰网 AI · 🔥 0 - PHP2Shell Flaws Trigger Emergency Patches and Widespread Shutdowns
PHP released fixes for two critical, unauthenticated remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Government, hospital, university and commercial services in Europe and Asia were temporarily taken offline while operators patched, after reports of early exploitation. OpenAI said GPT-5.6 Sol helped researchers identify the flaws, although agencies differed on whether exploitation had been confirmed.
The Next Web · 🔥 0
Experience and discussion from the community
Share my PHP2Shell experienceAsk about PHP2Shell
Nobody has shared their experience with PHP2Shell yet.