cyber.hendryadrian.com
Security News · reversinglabs.com

PHP2Shell Disclosure Turmoil Follows AI-Assisted Exploit Discovery

· Original article ↗

Summary

Reversing Labs says AI-assisted research chained dormant PHP flaws CVE-2026-109618 and CVE-2026-109619 into PHP2Shell. It reports that pre-disclosure leaks triggered panic and early exploitation attempts before a patch was released.

Key points

  • Reversing Labs says AI tools helped researchers chain PHP vulnerabilities that had been known since 2024 into the PHP2Shell exploit.
  • The article identifies the flaws as CVE-2026-109618 and CVE-2026-109619 and gives them a CVSS score of 9.2.
  • It says the exploit could enable remote code execution, access to sensitive information, or covert data theft on affected servers.
  • The article reports that technical details appeared on security forums before the agreed disclosure date, followed by further announcements and leaks.
  • It says the disclosure turmoil led to panic, system shutdowns, and early exploitation attempts before the patch was released; it does not specify affected versions or patch details.

Article Details

Event Type
Disclosure of the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619, followed by reported early exploitation attempts before the patch was released.
Impact
The vulnerabilities could allow attackers to execute code on affected servers, read sensitive information, and covertly steal data. The article reports that premature disclosure of technical details contributed to panic and system shutdowns. Websites using affected PHP versions, including platforms such as Wikimedia and Wordpress, were described as at risk.

CVE

CVE-2026-109618Last week, PHP imploded, following the disclosure of the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. CVE-2026-109619Last week, PHP imploded, following the disclosure of the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. 

Products

PHPLast week, PHP imploded, following the disclosure of the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Wikimediaprovided the spark that led to an exploit being developed. Large website building platforms, like Wikimedia and Wordpress, are at risk. The flaw was inherent to PHP, allowing even the most secure sites usingWordPressthe spark that led to an exploit being developed. Large website building platforms, like Wikimedia and Wordpress, are at risk. The flaw was inherent to PHP, allowing even the most secure sites using affected versions

Related Articles