PHP2Shell: AI Found Two PHP RCEs in Two Days, Patching Took Two Months
Every PHP deployment now faces a four-day exploitation window that AI-accelerated discovery makes routine and human-paced patching cannot close. WAF rules delay attackers but do not stop them; teams on EOL versions should isolate machines before the next PHP2Shell arrives.
Two unauthenticated remote-code-execution vulnerabilities in PHP's multipart POST parsing path, CVE-2026-109618 and CVE-2026-109619, went from discovery to patch on a two-month timeline even though the finding phase finished in two days. The bugs live in request-handling code introduced in the PHP 5.4 era, meaning roughly twenty years passed without anyone catching them. GPT-5.6 Sol found the first bug; the error pattern was written into a SKILL.md audit guide, and an agent used that guide to sweep the codebase and find the second CVE in the file-upload progress code. A single crafted multipart POST request triggers the memory corruption before application code runs, with no authentication required.
All PHP SAPIs are affected. Apache mod_php is the most dangerous because the interpreter shares Apache's process address space, so memory corruption can take down the web server itself. WordPress, Drupal, and Laravel sites cannot fix this by swapping plugins; only the PHP binary upgrade works. Fixed branches are 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and CISA's guidance for EOL versions is to take machines offline. The maintenance side was already thin: Debian's PHP packagers receive less than $700 per month in sponsorship even though PHP backs 69.3% of websites.
The same discovery-side acceleration shows up in Chrome's security bulletin: Chrome 156 fixed 353 vulnerabilities, compared with 21 and 26 in Chrome 141 and 142, with AI-company researchers submitting four of the six severe bugs. A PoC was circulating four days before the fix; Cloudflare's CEO counted thousands of exploitation attempts before disclosure, tens of thousands 45 minutes after, and hundreds of thousands within two hours. WAF rules and take-downs bought time, not safety. The consequence for infrastructure owners is that AI has changed how fast holes get found, but not how fast patches travel through backport, distribution, and restart windows.
A single known vulnerability can now be turned into a class-wide scan by capturing its error pattern as SKILL.md, which makes one expert's mental model runnable by hundreds or thousands of agents at once.
Patch distribution set the two-month pace in this incident: four branch backports, runtime-specific restart windows, and WordPress and Drupal ecosystem releases all had to finish before deployments were safe.
Chrome 156 fixed 353 vulnerabilities compared with 21 and 26 a year earlier; that jump is a better measure of AI-assisted auditing's backlog-clearing capacity than of Chrome becoming more fragile.
CISA's "no observed attacks" and CERT-EU's "PoC circulating" are both plausible, and the useful signal is that official monitoring trails attacker behavior; attackers only need the PoC to change hands once.
The varying government responses, from Finland taking sites offline to the NSA ordering updates, show that when no patch exists, reducing exposure beats preserving availability; future EOL incidents will force the same tradeoff.