PHP releases fixes for two critical PHP2Shell vulnerabilities

PHP’s official security archive lists 2 critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The affected PHP lines received fixes on October 21, 2026, and the project called for immediate updates.

Calif researchers found the flaws with human-led analysis, while an LLM companion assisted part of the exploitation work. AWS later reported a PHP2Shell attempt dated October 17, 4 days before public disclosure, but said real-world success was unclear.

The incident shows why patch timing matters when old web software is widely deployed. It does not prove that AI caused the attack or that the whole internet was compromised.