Docker vs Wiz

OpenAI Leads Global Response to Critical PHP Vulnerabilities

The critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, were disclosed in late October 2026 with a CVSS score of 9.2, affecting ~70% of websites since PHP 5.4. They enable unauthenticated remote code execution and memory disclosure. The German BSI issued a level 3 (orange) warning, and CISA added them to its KEV catalog, ordering federal agencies to patch within 3 days. Patches were released for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with backports for older branches, but older versions remain unpatched. Active exploitation has been confirmed, with millions of attempts. AI models like GPT-5.6 Sol and Gemini 4 Argon demonstrated exploitation within hours, highlighting AI's dual role. a16z analysis notes AI agents have narrowed the patch gap from weeks to hours, citing incidents like PaperCut where 395 organizations were compromised, and predicting a 'worm era'. Mitigations include disabling session.upload_progress and setting memory_limit=-1.

• PHP2Shell (CVE-2026-109618, CVE-2026-109619) is a critical vulnerability with CVSS 9.2, affecting ~70% of websites since PHP 5.4, allowing unauthenticated RCE and memory disclosure.
• Patches released for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with backports for older branches, but older versions remain unpatched; CISA added to KEV, ordering federal agencies to patch within 3 days.
• AI models like GPT-5.6 Sol and Gemini 4 Argon demonstrated exploitation within hours, and a16z analysis indicates AI agents have reduced the patch gap to hours, with incidents like PaperCut compromising 395 organizations in 48 countries.