PHP2Shell: The Lock on 7 Out of 10 Websites Had Been Open for Over a Decade and an AI Found It

Madrid. Imagine the lock on almost 7 out of 10 websites in the world had a flaw. That it had been there for over ten years and nobody had managed to pick it. And that this summer someone finally did, with the help of artificial intelligence.

This is not a hypothesis. It is called PHP2Shell, the name given to two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619) that have put half the internet on alert this week.

What happened

PHP is the technology behind many of the websites you visit every day, WordPress included. The two flaws, rated 9.2 out of 10 in severity (CVSS), allowed an attacker to run code on a server remotely, without a password and with very little effort. They affected versions going back to PHP 5.4, more than a decade of vulnerable code in plain sight.

After the discovery, a group of experts worked in secret for two months to fix it before anyone else found it. They did not quite make it in time. Amazon detected an attack attempt four days before the flaw went public, and since 21 October, the day PHP released the patches (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35), active exploitation has already been observed.

The part that catches our attention most

It is not the flaw itself. It is who found it and how long it took. AI finds in weeks what had stayed hidden for over ten years despite decades of human review.

That helps defenders, but it helps attackers too. And it changes the variable that matters most in cybersecurity, time. The window to react is no longer measured in weeks but in hours.

It is exactly what we have been warning about since we analysed the impact of Claude Mythos, the model capable of uncovering vulnerabilities hidden for 27 years, and what Luis Bravo discussed on The Officer about AI and regulation. When artificial intelligence finds holes faster than organisations can patch them, security stops being a department and becomes a race. PHP2Shell is not an isolated case, it is the confirmation of a pattern.

What you should do today

If you have a website, today is a good day to ask whoever manages it a one-minute question. Does it run on PHP and is it already updated? The only complete fix is updating to the patched versions (8.2.35, 8.3.36, 8.4.27 or 8.5.12).

If your site runs on an old branch without official support, PHP 8.1 or earlier, vendor patches with extended support exist, but now is the time to plan the migration.

And if you manage technology at a larger scale, the lesson runs deeper. An up-to-date version inventory, the ability to patch in hours and continuous code validation, including AI-generated code, which as we have reported contains vulnerabilities in around 45% of cases. It is the philosophy behind ADA, where every delivery is automatically validated against security criteria before reaching production.

The era when a flaw could sleep in the code for ten years is over. The question is whether your organisation finds out from the patch or from the attack. If you prefer the former, let’s talk.