AI-Assisted Discovery of the PHP2Shell Vulnerabilities
36氪 reports that CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, allow unauthenticated attackers to execute arbitrary programs on PHP-backed servers through crafted HTTP requests. It says AI-assisted scanning played a role in finding the flaws, while citing claims from the PHP Foundation and OpenAI and Wiz.
The reported use of AI tools in discovering remotely exploitable PHP vulnerabilities makes the incident relevant to AI-assisted security research and the reliability of automated vulnerability scanners.
（本文作者为 AI价值官，钛媒体经授权发布）
文 | AI价值官，作者丨鹿咔咔，编辑丨美圻
一种危险发生了。
CVE-2026-109618与CVE-2026-109619，对绝大多数人来说，这是两组不知所谓的编号，事实上，上周披露的这两个漏洞是网络安全历史上最严重的漏洞事故之一。
它们合称PHP2Shell漏洞。
不需要太多的常识，只要列出几个事实，普通人大概就能理解它的危险。
#PHP Foundation#PHP2Shell#Anthropic#Claude Mythos#OpenAI#Daybreak Red#Wiz#Wiz Atlas#Gemini 4 Argon#GPT-5.6 Sol