Frontier AI Models Used in Reported PHP RCE Exploit Development
A report says security teams from Calif and Wiz used frontier AI models to find two PHP remote-code-execution vulnerabilities and build exploits. The flaws, CVE-2026-109618 and CVE-2026-109619, are marketed as PHP2Shell. The report says a 2024 PHP Foundation audit had identified CVE-2026-109618 but could not determine how to create an exploit from the theoretical issue or agree on a fix. It cites an estimate that PHP2Shell could affect as much as 70% of the internet, including thousands of major websites, though the report does not substantiate that estimate. There is also disagreement over whether working exploit attempts occurred before the patch was released.
The report says frontier AI models helped turn a theoretical vulnerability into a full exploit, illustrating how AI may accelerate exploit development and compress the response window after security patches are announced.
The last week has seen a flurry of severe and critical software vulnerabilities affecting thousands of major sites and sending people into a panic. What’s going on here, and what can we do about it?
The bugs
If we want to understand what’s going on in the world of software security at the moment, we need to understand what’s going on with all these bugs. I’m not a cybersecurity expert, so I’m going to link to external explanations instead of going into the gory technical details myself as these people are always going to do a better job at that.
PHP2Shell – CVE-2026-109618 and CVE-2026-109619 (a.k.a. “the big one in the news”)
Two different security teams, one from California security company Calif (as part of OpenAI’s “Patch the Planet” program) and another from Israeli-U.S. cloud security company Wiz (they’re part of Google Cloud, apparently), both found these two Remote Code Execution (RCE) bugs in PHP. They were both using frontier AI models (a.k.a. LLMs, specifically GPT-5.6 Sol/Gemini 4 Argon) to find these vulnerabilities and build the exploits.
#PHP#PHP2Shell#CVE-2026-109618#CVE-2026-109619#Calif#Wiz#OpenAI#GPT-5.6 Sol#Gemini 4 Argon#PHP Foundation