Vulnerability / research
AI-assisted PHP2Shell research leads to critical PHP fixes
Reported
Published here
What happened
Researchers used AI to uncover and demonstrate PHP memory-safety flaws enabling unauthenticated code execution or memory disclosure. Separately, AWS reported exploitation attempts against honeypots dating to October 17.
Parties and reporting
AI tools and systems: Wiz Atlas, Gemini 4 Argon (defensive research), GPT-5.6 Sol (defensive research), PHP / CVE-2026-109618 and CVE-2026-109619
Outcome
PHP released fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. AWS says whether the pre-disclosure attempts would have succeeded on real systems remains unclear. Configuration workarounds are incomplete.
Operating lesson
Patch the PHP runtime and verify every worker uses the fixed release; investigate from the earliest observed attempts, rather than starting at the advisory date.
Evidence and limits
October 20 is the PHP team’s advance public warning; detailed research and patches followed October 21. AI use is established for defensive research, not for the observed attackers. CMS exploit demonstrations are not confirmed customer breaches. Available upstream fixes do not establish universal patching or containment.
Sources
- PHP advance warning, advisory and fixed releases
Primary source ·
- Wiz AI-assisted discovery and controlled demonstrations
Primary source ·
- OpenAI coordinated disclosure with Calif and PHP
Primary source ·
- AWS observed attempts before detailed public disclosure
Primary source ·