ZeroFox Intelligence Flash Report - AI-Discovered PHP Vulnerability

ZeroFox Intelligence Flash Report - AI-Discovered PHP Vulnerability

Product Serial: F-2026-10-22a

TLP:CLEAR

In this Flash Report, ZeroFox researchers report on the recently AI-discovered PHP vulnerability and discus its potential impact.

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

• On October 21, 2026, the PHP Foundation released emergency patches for two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”), and allows unauthenticated remote code execution (RCE).
• Multiple parties reportedly independently discovered the flaws in August 2026 using frontier artificial intelligence (AI) models, which reportedly also reduced the effort required to build working exploits.
• ZeroFox has observed reporting of early exploitation attempts of both CVEs, urgent patching warnings from U.S. and European government agencies, and several government websites taken offline as a precaution.
• ZeroFox assesses that organizations running end-of-life PHP versions face the highest exposure risk, as no official patch is available for those versions at the time of writing.
• ZeroFox assesses with moderate confidence that exploitation of unpatched and end-of-life PHP deployments will almost certainly continue and expand in the coming weeks, and that this event will very likely accelerate AI-assisted vulnerability discovery and exploitation.