AI-assisted disclosure of PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619

Researchers utilizing AI tools discovered that dormant vulnerabilities in PHP could be chained into a functional exploit known as PHP2Shell, impacting over 70 percent of the internet. The resulting disclosures, alongside a similar incident earlier this year called CopyFail, caused widespread panic, early exploitation attempts, and turbulent patch management across affected systems. The author argues that as AI accelerates vulnerability discovery and exploit development, the security community must carefully coordinate disclosure processes and adopt multi-layered defensive strategies. Open article →