PHP2Shell and the AI Exploit Race: A Defender’s Playbook for the Critical PHP Flaw

Two critical bugs in PHP were found with help from frontier AI, and attackers are already probing for them. Here’s what happened, why AI changes the timeline and how to protect your servers. Image by the author. PHP is the engine behind WordPress, Drupal, Laravel and a huge share of the web. For more than a decade, two weaknesses sat inside it unnoticed. On Oct. 21, 2026, PHP shipped emergency fixes for them. The bugs, tracked as CVE-2026–109618 and CVE-2026–109619 and nicknamed PHP2Shell, can let an attacker with no login run code on a server [1][2]. What sets this apart from a routine patch