🇿🇦 English, 23 October 2026, AI-assisted vulnerability
Two critical PHP vulnerabilities trigger global cyber security alert
Details of the flaws, dubbed PHP2Shell, leaked before planned disclosure and patching.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code remotely on vulnerable servers without authentication. PHP is widely used to build websites, web applications and back-end services, including platforms running WordPress, Drupal, Joomla and Magento. Researchers used AI-assisted research to produce a viable attack method, which was then used to identify the flaws in 2024 but could not be exploited until now.