SI helps find two critical PHP vulnerabilities: emergency updates released, some government sites taken offline during patchingHistory·PHP2Shell vulnerabilities found by SI: disclosure and attacks
SI can now turn an old bug into a working exploit in hours, so fixes have to come just as fast; this time defenders got there a little earlier.
Sources 3
On October 21, PHP released updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (plus fixes for the unsupported 7.4, 8.0 and 8.1 branches) for two memory-handling bugs, CVE-2026-109618 and CVE-2026-109619 (9.2 on the CVSS scale), which allow code to be executed on a server without logging in. According to Wiz, all versions from PHP 5.4 onward are affected, and PHP runs roughly 70% of websites. Wiz names Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol as the tools used; it says SI cut the path from a bug to a working exploit chain from months to hours. According to TNW, the firm Calif found the first bug in August using GPT-5.6 Sol. According to the BBC, agencies in several countries advised organisations that had not managed to update to consider taking their sites offline: Finland temporarily shut down its public government services, the Dutch cybersecurity agency took its own site down, and the US NSA gave similar advice. According to TNW, Cloudflare switched on protective rules for all customers nine hours before disclosure, and OpenAI said it expects a sharp rise in similar findings.