PHP2Shell: AI-discovered PHP flaws collapse the window between patch and exploit

Two AI-discovered flaws in PHP

A blog post by Drew Silcock, published 23 October after reaching Hacker News' front page, walks through a week in which several severe vulnerabilities landed almost at once. The largest is a pair of remote code execution bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and branded PHP2Shell.

According to the post, two separate teams found the bugs: one at California security firm Calif, working within OpenAI's "Patch the Planet" programme, and one at Wiz, the cloud security company now part of Google Cloud. Both reportedly used frontier AI models — GPT-5.6 Sol and Gemini 4 Argon — not only to locate the flaws but to build working exploits.

The twist, per Silcock, is that one of the bugs was already known. A 2024 PHP Foundation audit, funded by the Sovereign Tech Agency, flagged CVE-2026-109618, but it was shelved because nobody could turn the theoretical issue into a practical attack. Converting theoretical weaknesses into full exploits is exactly what large language models now do well, he writes: point an agent at a codebase after a patch notice and it will read the diffs, identify the security fix, work backwards to the underlying bug and carry on to a working exploit. His blunt conclusion is that the moment a patch is announced should now be treated as the last moment a full exploit is not circulating.

Wiz Research's write-up, cited in the post, estimates the bugs affect around 70% of the internet. Named victims include Wikimedia, DeviantArt, large parts of the UK government, Japanese banking systems and the BBC's website for The Traitors.

A collapsed embargo

The coordinated disclosure fell apart before the patch shipped. A Hacker News user, petecooper, posted about the CVEs apparently unaware an embargo existed, prompting a hurried statement from The PHP Group, which moved the release forward a day, from Thursday 22 to Wednesday 21 October. The leak included CVSS scores of 10.0; the real scores were 9.2.

The PHP Foundation then blamed Calif for leaking a video of the exploit in action — complete, per Silcock, with background music and a dancing anime figure — and Chainguard for publishing fixes six hours before the embargo lifted. Both, it argued, let attackers beat systems administrators to the punch. Silcock describes the whole chain of failures as compressed into roughly 17 hours, and notes the vulnerability was being exploited in the wild by the time the patch was actually available. Urgent announcements from the UK, EU, Japanese and US governments added to the panic, which Silcock attributes partly to PHP's long-standing reputation for insecurity leaving everyone primed to overreact — while conceding the bug may genuinely deserve the alarm.

Exploit slop versus real exploits

Skeptics argue the threat is overstated because LLMs frequently produce non-working proofs that cheat or rely on bad assumptions, such as assuming the server runs attacker-uploaded code. Silcock, citing security educator LiveOverflow, counters that a flood of broken exploits does not make the vulnerability hypothetical: ten thousand useless ones are irrelevant if a single one works. The noise also means human expertise remains essential — if you cannot evaluate what the model produced, you cannot tell whether it cheated.

eMudhra's tiny private keys

The same week, Mozilla blocked eight intermediate certificates from Indian certificate authority eMudhra after a pseudonymous researcher known as "Wayne" reported that their private keys were trivially small — values like 115, 56 and 4, where a secure key should be an enormous number. There is no indication AI was involved in the discovery, but researcher Scott Helme noted that Claude recovered the private keys from a single prompt. As of 23 October, eMudhra had announced it will exit the certificate authority business.

Why it matters

Silcock's central claim is that LLMs have compressed the time from learning about a serious remote code execution bug to facing sophisticated automated attacks from weeks or months down to hours or minutes. That breaks the assumptions coordinated disclosure depends on: embargoes, early patches and staged rollouts all assume attackers need time. Security teams should now assume an exploit exists the instant a fix is announced, and the volume of AI-generated junk exploits means experienced humans are still needed to separate the one real weapon from the pile of duds.