Original: https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble

Every single year since 2010, someone on Hacker News or X posts a hot take declaring that PHP is dead. And then, in October 2026, frontier AI models uncovered a decade-old memory corruption flaw in the core PHP runtime engine, and suddenly 70% of the internet had to scramble into emergency patching mode.

As reported by BBC News , government portals, Wikimedia systems supporting Wikipedia, public health boards in Scotland, Edinburgh Council, the Finnish government, and even the Netherlands National Cyber Security Centre (NCSC) temporarily pulled services offline this week as a precaution against two critical vulnerabilities collectively dubbed PHP2Shell ( CVE-2026-109618 and CVE-2026-109619 ).

Both vulnerabilities carry a critical CVSS v4.0 score of 9.2 and affect every release of PHP from PHP 5.4 through PHP 8.5 .…