Member-only story

AI Just Found a 14-Year-Old Bug in PHP. It Won’t Be the Last.

Lakin Mohapatra

18 min read5 hours ago

Inside the three weeks that changed vulnerability research: PHP2Shell, Node2Shell, a broken certificate authority, and the new reality for developers who ship code to the internet.

Press enter or click to view image in full size

TL;DR

PHP2Shell (CVE-2026–109618 / CVE-2026–109619, CVSS 9.2): two memory-corruption bug classes hiding in core PHP for 14 years , found and weaponized within weeks by three independent teams all using frontier AI. Pre-auth RCE on WordPress, Drupal, Joomla, even on a “Hello World” app.

Node2Shell (CVE-2026–111497, CVSS 8.1): an out-of-bounds write in the Brotli decoder bundled with Node.js, reachable from auto-decompressing request bodies , node:zlib , and even outbound fetch() calls. Patched in Node 22.23.4 / 24.22.1 / 26.12.1.…