The FBI and NSA have issued urgent warnings regarding two critical flaws within the PHP programming language. Known as "PHP2Shell," these vulnerabilities allow for remote code execution and were discovered through the use of advanced artificial intelligence models.
Gemini 4 Argon and GPT-5.6 Sol lead the charge in vulnerability discovery
Artificial intelligence is becoming a central player in the discovery of critical software flaws. According to the report, Wiz Research utilized multiple AI models, including Gemini 4 Argon and the Wiz Atlas system, to identify the vulnerabilities. this discovery highlights a shift in cybersecurity where machine learning can pinpoint complex code weaknesses that might elude human researchers.
OpenAI’s GPT-5.6 Sol also played a significant role in the research process . While Wiz Research independently discovered and reported both flaws, the cybersecurity startup Calif reportedly used GPT-5.6 Sol to identify one of the vulnerabilities. This dual-track discovery by different AI-integrated entities underscores the accelerating pace of automated vulnerability research.
A massive attack surface covering 69.3% of the internet
The scale of the potential impact is massive due to the ubiquity of the PHP programming language. W3Techs estimated that PHP powers 69.3 percent of all websites with a detectable server-side language as of October 21. Because PHP is a cornerstone of the web, any flaw in its core can have a cascading effect across the global digital infrastructure.
This widespread usage means that common platforms like WordPress are inherently linked to the security of the PHP core. As the report notes, PHP is used to generate dynamic pages and interact with databases, meaning a breach in the language can provide a direct path to a server's file system or sensitive data . This makes the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, a high-priority concern for web administrators globally.
The high-risk profile of mod_php configurations
Security experts have identified mod_php as the most dangerous configuration for administrators to manage.. The PHP security advisory notes that in this specific setup ,an unauthenticated request could trigger an attack before any application-level code even begins to run. This makes it significantly easier for attackers to gain a foothold without needing valid credentials.
Immediate mitigation is required for users running PHP versions 8.2, 8.3, 8.4, and 8.5. The FBI has advised that if an update cannot be applied immediately, organizations should consider taking their systems offline to prevent remote code execution. The agency also recommended monitoring for suspicious activity, such as PHP processes unexpectedly launching command shells or downloading unauthorized files.
Which threat actors are targeting CVE-2026-109618?
While the technical details of the PHP2Shell flaws are clear, several critical questions remain unanswered. It is currently unverified whether malicious actors have already begun active, large-scale exploitation of these vulnerabilities in the wild. Furthermore, while the FBI and NSA have issued guidance, the report does not specify if any particular threat groups have been linked to the discovery or the potential use of these AI-identified flaws.
Comments 0