// ZDNET — INTELLIGENZA ARTIFICIALE
PHP2Shell: Haven’t patched yet? Take these steps now to mitigate
The PHP Project provides instructions to stop further RCE exploits in limited settings.
A flaw in PHP triggered a worldwide scramble to patch vulnerable websites, and now, further instructions have been issued by the PHP Project to prevent “an unlikely Remote Code Execution (RCE) vector” in PHP2Shell attacks.
Also: Chrome warns you about suspicious websites now
PHP2Shell refers to a pair of PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that have each earned critical severity scores of 9.2 and impact most PHP builds. The PHP Project released patches to fix these bugs on Wednesday, and the critical nature of these flaws prompted a worldwide scramble to apply PHP’s fixes as quickly as possible.
Why the rush? Because PHP (a recursive acronym for Hypertext Preprocessor) is a general-purpose programming language that provides the backbone for many of the websites and services we access daily — everything from WordPress websites to e-commerce platforms.
According to Wiz’s security team, which discovered the vulnerabilities with the help of AI, PHP can be found on 70% of the world’s websites.
“These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk,” Wiz says.
Armed with these vulnerabilities and targeting an unpatched system, attackers could execute code on affected servers or read sensitive process memory, stealing data and infiltrating corporate networks in the process.
Also: AI a ‘force multiplier’ for low-skilled threat actors
Wiz goes on to make an interesting point: While AI assisted in the discovery of these vulnerabilities, AI could also be used to exploit them. Developing an attack chain and demonstrating the exploitability of these bugs “required an exceptionally complex chain of steps,” according to the researchers, which would be “at the edge of what human researchers could practically achieve.” However, frontier AI models “substantially reduced that barrier, turning a longstanding flaw into an exploit.”