PHP2Shell: AI uncovers critical RCE in PHP

<a href="https://news.ycombinator.com/item?id=50181058">Comments</a>

<a href="https://news.ycombinator.com/item?id=50194070">Comments</a>

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively

<p>The PHP project shipped emergency fixes this morning (Oct 21, 2026, about 9:35 AM ET) for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, now

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of

PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP

Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before security patches were released on Wednesday. [...]

OpenAI is taking credit for finding the PHP2Shell vulnerabilities, but now someone has to apply all these patches, www.theverge.com/tech/1015906...