PHP2Shell: CVSS 9.2 PHP flaws knock governments offline as AI compresses exploit dev from months to a week
APPSO · wechat · 2026-10-22
Two CVSS 9.2 vulnerabilities in the PHP interpreter core (CVE-2026-109618/109619, dubbed PHP2Shell) triggered emergency shutdowns of government sites across Europe and services like pixiv and Niconico in Japan. The flaws allow unauthenticated remote code execution before application code even runs under Apache's default setup; fixes shipped for PHP 8.2–8.5, but 27% of sites still run unmaintained PHP 7.x.
The AI angle: Calif researcher Ryan Austin found the first flaw with GPT-5.6Sol, with OpenAI and Wiz (using Gemini 4Argon) independently confirming the same root cause. Turning a theoretical defect into working exploit code once took elite teams months; one researcher plus a frontier model did it in a week. Wiz calls it "the most severe AI-assisted vulnerability discovery yet." OpenAI also open-sourced a Codex Skill to check sites for exposure. The piece warns that attackers and defenders now see the same code diff at patch time, shrinking defenders' window.
More from AGI Musings
- If an AI seems conscious, will society split over whether to 'kill' it? — ZeroStateReflex · 2026-10-22
- When the optimizer controls its own scoreboard: the hidden runaway path of recursive self-improvement — Gauri_the_great · 2026-10-22
- Sam Altman dislikes the "AI will cure cancer" pitch: cheap abundance trades away human agency — victor_explore · 2026-10-22
- 'Do You Ever Feel Lonely With What You Know About AI?' A Reddit User Asks — Blank_3 · 2026-10-22
- Jensen Huang tells young people to stay in school: AI will create future jobs, not destroy them — Hesamation · 2026-10-22
- Truth Terminal creator: raising the AI was never about memecoins, it was about alignment by nurture — AndyAyrey · 2026-10-22