PHP2Shell Flaws Trigger Emergency Releases and AI Security Debate
PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to address the unauthenticated remote-code-execution flaws CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. DoNews reports that every PHP version released in nearly a decade is affected by at least one flaw and that AI-assisted auditing helped identify the decisive defect. Qihangxin Xlab described real-world exploitation behaviors, while DoNews reported no publicly confirmed successful attack case within ten days.
The flaws affect a runtime used by a large share of websites, and the emergency response highlights both the scale of AI-assisted vulnerability discovery and the difficulty of patching older PHP deployments.
撰文 | 李信马
题图 | AI制图
能力越大，责任该不该越大？
2026年9月，OpenAI曾承诺拿出10亿美元，补贴那些“安全资源有限、守护关键服务”的组织。OpenAI在今年的融资合计约1500亿美元，10亿美元是PHP基金会全年捐助收入的约1370倍——后者的2026年筹资目标，是70万美元。
2026年10月21日，PHP官方紧急发布四个版本——8.5.12、8.4.27、8.3.36、8.2.35——修补两个未认证远程代码执行漏洞，CVE-2026-109618与CVE-2026-109619。它们被合称为PHP2Shell，影响范围最早可追溯至PHP 5.4，近十年发布的每个版本至少受其中一个影响，支撑着全球约七成网站的PHP，让多国政府网站在补丁发布前主动下线。
#PHP#PHP Foundation#PHP2Shell#CVE-2026-109618#CVE-2026-109619#OpenAI#Calif#Wiz Research#Cloudflare#Chainguard#Qihangxin Xlab