Overview
- Developer teams published security updates on 21 October that fix two remote‑code‑execution flaws, CVE-2026-109618 and CVE-2026-109619.
- AI-assisted research by groups including Wiz and OpenAI produced concrete attack methods in August 2026 that sped exploit development from months to days.
- Security firms and cloud providers reported millions of scanning and exploit attempts and honeypots recorded the first confirmed successful compromises, prompting CISA to add php2shell to its Known-Exploited-Vulnerabilities catalog.
- Many organizations took websites and services offline to apply patches and the internet scanner Censys still reports about four million PHP instances in Germany that report vulnerable version numbers.
- The PHP Foundation called the delay in fixing the decade‑old bug a structural failure, vendors warn of more AI-driven discoveries, and experts say legacy systems and embedded devices will be hardest to secure without stronger resourcing and update rules.