The last week has seen a flurry of severe and critical software vulnerabilities affecting thousands of major sites and sending people into a panic. Two Remote Code Execution (RCE) bugs in PHP, dubbed PHP2Shell, were found by separate security teams from Calif and Wiz, both using frontier AI models to find the flaws and build working exploits. Estimates suggest the bug could affect upwards of 70% of the internet, with thousands of websites affected, including the Wikimedia Foundation, DeviantArt, much of the UK government, Japanese banking systems and the BBC's The Traitors website.
One of the bugs, CVE-2026-109618, had actually been flagged in a 2024 security audit by the PHP Foundation, funded by the Sovereign Tech Agency. The team set it aside because it had bigger concerns and could not agree on a fix, reasoning that no one could build a real exploit from the theoretical issue. AI models have changed that calculation. They are very good at turning a vague vulnerability description into a full exploit, and agents can now scan patch diffs within moments of release to work backward to the flaw.
The embargo collapsed when a user named petecooper posted about the CVEs on Hacker News, apparently unaware an embargo existed. The PHP Group hurriedly brought the patch forward from Thursday 22nd to Wednesday 21st, but the fix was still not due for another day. The leaked CVSS scores of 10.0 were also inaccurate, with the actual score listed as 9.2. By the time the patch was released, the bug was already being exploited in the wild.
The PHP Foundation blamed Calif, which reportedly leaked a video of the exploit, and Chainguard, which published fixes six hours before the embargo lifted. The sequence of events is confusing, but it appears that several linked failures let attackers reach systems before administrators could patch them.
Source: Hacker News · Summarized by HeadlinesBriefing