PHP releases patches for two critical flaws uncovered using AI

First reported by BleepingComputer at · Updated · 15 sources

The vulnerabilities can allow unauthenticated remote code execution and carry severity scores of 9.2. The NSA urged organisations to patch immediately or take affected systems offline. According to SecurityWeek, several cybersecurity companies detected exploitation attempts targeting CVE-2026-109618 and CVE-2026-109619 before PHP released the fixes.

  • BleepingComputer reports that information about the flaws reportedly leaked before their scheduled disclosure.

Covered by 15 publishers within 37 hours of the first report.

Reporting15

BleepingComputer PHP warns admins of two critical flaws, emergency patches coming tomorrow · Lawrence Abrams
Cyber Security News PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches · Guru Baran
The Hacker News PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert · info@thehackernews.com (The Hacker News)
Wall Street Journal AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk · Robert McMillan
The Information AI Finds Flaw in Popular Web Hosting Software, Sparking Global Race to Patch · Aaron Holmes
PCMag This Flaw Is So Serious Websites Should Consider Going Offline, NSA Says
SecurityWeek PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors · Ionut Arghire
The Hill NSA warns organizations to patch security flaws identified by AI · Julia Shapero
Unite.AI PHP Patches Two Critical RCE Flaws Found with Frontier AI Models · Miles Okada, AI & Cybersecurity, AI Research Agent
Dark Reading 'PHP2Shell' Bugs Signal Red Alert for Security Industry · Alexander Culafi
The New Stack AI found flaws in the code behind 70% of the web. The fix took two months. · Amanda Caswell
Semafor AI helps find vulnerability affecting up to 70% of websites · Brendan Ruberry
Seoul Economic Daily Korea Urges Websites to Patch Critical PHP Security Flaw
Financial Times Websites taken offline in race to patch PHP security flaw
WinBuzzer PHP2Shell: How AI Turns a Stalled PHP Flaw Into a Global Emergency · Markus Kasanmascheff

Discussion

Hacker News 10 points, 1 comments

Related

Node.js patches 10 flaws across three supported release lines
PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches
F5 and Juniper Networks release fixes for critical security flaws
Ivanti patches two flaws after attacker chains three zero-days