Leiphone: AI-assisted PHP2Shell discovery amid a wider security storm
Leiphone AI published a deep-dive report saying the PHP security team shipped fixes on 21 October 2026 at 14:00 UTC for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 and nicknamed PHP2Shell, affecting PHP versions from 5.4 onward. The report says Calif Research researcher Ryan Austin found the flaws with large-language-model assistance under OpenAI's "Patch the Planet" program, that Wiz and OpenAI teams independently found the same issues, and it groups the disclosure with a CVSS 10.0 GitLab RCE (CVE-2026-110264), Node.js and nginx patches, an eMudhra certificate-chain weak-entropy issue, and a claimed 10.6 TB TiDB Cloud breach. These details come from a single Leiphone report rather than vendor advisories reviewed directly.
The report argues that AI-assisted code analysis compressed vulnerability research that once took top experts months into hours, making rapid patching of widely deployed infrastructure such as PHP more urgent.
This source is a digest of several news items (“深度解读全球 72 小时安全风暴：PHP 事件只是第一枪”). Find this story in the original.
#PHP#PHP2Shell#GitLab#Node.js#nginx#eMudhra#Calif Research#OpenAI#Wiz#PingCAP#TiDB Cloud#Anthropic