Evidence Passport
AI helps find PHP2Shell flaws in code behind most websites
Top story 2 in the issue of 22 October 2026, in 42 AI Cybersecurity.
Original source
AI helps find PHP2Shell flaws in code behind most websites
The two flaws, CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0; Calif.io and Wiz found them with GPT-5.6 Sol and Gemini models, and patches followed after two months.
Evidence
Evidence: Independent validation (evidence step 6 of 6)
Confirmed by a separate team or an external test: the strongest step.
The story in three lines
- Key finding
- AI-assisted researchers found two CVSS 9.2 flaws in PHP's core engine, which runs about 70% of websites.
- Significance
- Technical: frontier models are now finding critical bugs in core internet software, not just toy code.
- Takeaway
- Patch PHP now; expect faster bug discovery by attackers and defenders alike.
Later coverage in the journal
No later coverage in the journal yet.
Corrections and updates
No corrections or updates recorded for this item.
This page is generated from the issue and stays at the same address. It adds nothing that is not in the issue, the source link or the corrections log.