Kazak explains the PHP2Shell vulnerability unearthed by AI: Discovery took only two days, while fixing it took two months.

The author reviews the full timeline of two PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell) that started with a CVSS score of 10. The review covers the initial data leak, the release of demonstration videos, the preemptive shutdowns of government websites across multiple countries, and the deployment of patches at 10 PM on October 21. It is also noted that these vulnerabilities were discovered with assistance from GPT-5.6 Sol, and OpenAI has since released a detection skill.