Breaking

AI-Assisted Discovery of PHP2Shell Flaws Triggers Global Patch Race and Millions of Exploit Attempts

October 23, 2026 at 01:10 EDT

Security
Software Dev & Coding
Foundation Models

PHP maintainers have released emergency fixes for two critical vulnerabilities that could let unauthenticated attackers execute code on vulnerable web servers. The AI-assisted discoveries, collectively known as PHP2Shell, prompted a worldwide patching effort as observed exploit attempts climbed into the millions.

October 23, 2026 · PHP2Shell

AI finds a web-scale fault line

Two critical PHP flaws can expose data or permit unauthenticated code execution. Emergency patches arrived as exploit attempts accelerated into the millions.

critical CVEs

Nearly 70%

of identifiable websites use PHP

5.4+

affected PHP versions

Millions

of observed exploit attempts

PHP's footprint across the web

Approximate proportional view of websites with an identifiable server-side language.

~70%

PHP

~30%

Other

From obscure bug to urgent defense

Long-lived defects

Memory-state bugs persist for more than a decade.

→

AI-assisted research

Models help find, chain and reproduce the flaws.

→

Coordinated fixes

Maintainers and providers test patches and protections.

→

Mass scanning

Exploit attempts surge after disclosure.

Defensive gain

AI helped researchers reproduce complex failures, develop detection and validate repairs before coordinated disclosure.

Operational constraint

Legacy releases, provider dependencies and rapid scanning leave administrators little time. Firewall rules reduce risk but do not replace patching.

Patch the runtime, then verify the estate

Supported fixes
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35Older releases
Upgrade or obtain a vendor backportAfter updating
Restart services and continue monitoring

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.