Essay says AI shrank PHP2Shell exploit time to hours
Original title: Is this the new cyber normal?
The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.
A commentary post argues that large language models compressed the path from a PHP remote-code-execution notice to working attacks from weeks to hours. It recounts Calif and Wiz finding CVE-2026-109618 and CVE-2026-109619 with GPT-5.6 Sol and Gemini 4 Argon, an embargo leak, and exploitation before the patch moved from October 22 to October 21. The PHP Foundation is said to blame a Calif exploit video and an early Chainguard fix publication. The author treats much of the resulting exploit code as non-working slop that still leaves real attacks possible.
Unconfirmed: This is an opinion essay; the 70% reach estimate, embargo-blame claims, and government reactions are the author’s account.
- The post says one bug was noted in a 2024 PHP Foundation audit and left unfixed.
- Leaked scores were described as CVSS 10.0, while the author says the actual scores were 9.2.
- The author estimates PHP2Shell affects upwards of 70% of the internet.
- Named sites in that estimate include Wikimedia, DeviantArt, UK government, and Japanese banks.
- The post says governments in the UK, EU, Japan, and the US issued urgent announcements.
Impact: Remote code execution on exposed PHP websites
| Product | Affected |
|---|---|
| PHP | — |
- Vendors
- PHP
- Organizations
- PHP FoundationCalifWizChainguard
- AI models
- GPT-5.6 SolGemini 4 Argon
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 |
From the original article
14 min read at drew.silcock.dev
The last week has seen a flurry of severe and critical software vulnerabilities affecting thousands of major sites and sending people into a panic. What’s going on here, and what can we do about it? If we want to understand what’s going on in the world of software security at the moment, we need to understand what’s going on with all these bugs.
By drew.silcock.dev by drewsberry · drew.silcock.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.