PHP has released emergency updates for two severe runtime flaws named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619.
Affecting versions back to PHP 5.4, the issues highlight risks where AI assists in weaponizing legacy primitives.
Fixes land in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Researchers from Wiz, Calif., and OpenAI who discovered and reported the vulnerabilities noted that artificial intelligence helped turn decades-old, dormant problems into operational attacks. These attacks could begin with a simple request to a remote computer, allowing unknown parties to run commands or read sensitive data from the system's memory.
Corrections and protection measures
The official PHP team has released the necessary fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older versions, such as the 7.4, 8.0 and 8.1 series, special source code fixes have been released. The only complete solution is to install the updates and restart services, such as the PHP management and execution programs.
Before the official release of the patches, Cloudflare recorded the first attempts at online attacks, but no successful breaches were confirmed at that time. As a precautionary measure, several organizations and government agencies in the Netherlands, as well as companies such as BambooHR, temporarily shut down their services.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
