Research noteResearched 22 Oct 2026 · published 22 Oct 2026, 16:27 IST · updated 22 Oct 2026

Research note: Two critical PHP flaws let attackers run code on web servers; fixed versions are out and AI helped find them

How we checked the PHP2Shell flaws, the fixed versions and the role of AI in finding them.

Research led by Mayank Sahu

Compiled with AI assistance (Claude by Anthropic)

Read the story →

At a glance

2searches run

3sources read

2sources used

6facts labelled

Mixedevidence strength · 3 of 5 facts (60%)

How we rate evidence: Some facts are confirmed, others rest on one report or on the company’s own claims. We count the share of known facts labelled Confirmed or Reported: 70% or more is Strong, 40–69% Mixed, below 40% Limited.

From sources to story

How many sources we read, how many we used, and how many are official or archived.

Read3Every source we opened

Used2Relied on for the story

Cited2Linked in the story

Official0From the company or a public body

Archived2Saved on the Internet Archive

How sure we are, fact by fact

321

Reported · 3 — Two or more independent, named outlets say it.
Unconfirmed · 2 — One report only, shown with its source.
Not known · 1 — Not announced or not answered yet.

Evidence map

Each row is a fact from the story; each column is a source. A filled dot means that source supports the fact.

Fact	Label	1OUT	2OUT
PHP released fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619, which allow remote code execution.	Reported
Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.	Reported
Amazon recorded an exploitation attempt on 17 October, four days before disclosure.	Reported
Both flaws are rated CVSS v4.0 9.2.	Unconfirmed
The PHP Foundation credited Calif, OpenAI and Wiz; Calif and Wiz said they used AI models.	Unconfirmed
How the attacker obtained details before disclosure.	Not known

Question

What we set out to check

Which versions are affected and fixed, whether the flaws are being exploited, what readers should do, and what role AI played.

Findings

What we found

Both sources give the same four fixed versions and agree that exploitation was seen on 17 October.
Tenable lists CVSS scores, credits and interim settings; Help Net Security lists affected server setups.
Both say AI lowered the effort to find or exploit the flaws.

Discrepancies

Numbers that differ

Help Net Security credits Wiz; Tenable says the PHP Foundation credited Calif, OpenAI and Wiz. We report the fuller credit list from Tenable, labelled as one source.

Method

Labels we chose and why

Reported for versions, dates and exploitation, carried by both.
Unconfirmed for CVSS and credits, seen in one source.

Open questions

What we could not verify

PHP’s own release notes, which we could not open directly.
OpenAI’s and Wiz’s own write-ups.

Can you help confirm one of these? Send us a source. When we find an answer, we update this note and the story, with the date.

Next steps

How we could improve this

Cite php.net and the researchers’ posts directly, and add hosting providers’ patch confirmations.

Research timeline

Research22 Oct 2026
Research note published22 Oct 2026, 16:27 IST
Story published22 Oct 2026, 16:37 IST

What we searched

PHP critical vulnerability CVE-2026-109618 patch October 2026
PHP2Shell fixed versions 8.3.36

Every source we read

Source	Used?	Why
Help Net Security Archived copy	USED	Versions, affected setups, Amazon findings, NCSC advice.
Tenable Archived copy	USED	CVSS, affected ranges, credits, interim settings.
Huntress	NOT USED	Similar detail.

Sources cited in the story

Research notes show our working. They are not peer-reviewed papers. Data: facts as JSON · How we report