One week after the October 21 "black Wednesday," when European governments urgently took web services offline because of a critical remote code execution vulnerability in the PHP core, the initial wave of panic and emergency patching has subsided. The incident, now known as PHP2Shell, is being recognized as a watershed moment that divides cybersecurity into "before" and "after."
The flaw, assigned CVE-2026-109618 and carrying a CVSS score of 10.0, affects the component that underpins roughly 70 percent of the web. For the first time in history, a vulnerability of this severity was discovered by a next-generation AI model during an automated audit rather than by human analysts.
Legacy code blind spot
The root cause lay in the multipart/form-data parsing routine that had remained untouched for decades due to PHP's strict backward-compatibility requirements. Human reviewers subconsciously trusted the code because it had "worked since the 2000s." AI models such as GPT-5.6 Sol from Calif and research tools from Wiz lack these cognitive biases. They ingested the PHP kernel into a mathematical model, constructed a dependency graph, and identified an edge case that produced a buffer overflow before control was handed to the web application.
Speed advantage shifts to attackers
The incident exposed a stark reality: AI-driven exploit generation now outpaces human response. Within days of the initial disclosure, attacker-operated LLM agents produced custom exploits for x86 and ARM architectures, generated polymorphic payloads that evaded signature-based WAF rules, and launched automated IPv4-wide scanners. Defenders, by contrast, had to coordinate maintenance windows, test patches, and verify production stability manually, leading many organizations to isolate servers entirely.
Immediate DevSecOps changes
Industry experts now state that post-factum patching is no longer viable. Required shifts include:
- AI fuzzing at compile time – Traditional SAST and DAST tools that rely on known patterns are considered obsolete; AI agents must continuously attack code inside CI/CD pipelines before it reaches the main branch.
- Legacy code reviews – Systems still running PHP 7.4 or other unmaintained runtimes are now priority targets for AI attackers and must be updated or refactored urgently.
- Autonomous AIOps protection – Web application firewalls must incorporate real-time AI engines capable of detecting anomalous traffic structures, such as the malformed multipart packets seen in the PHP2Shell case.
The PHP2Shell incident is not viewed as the end of PHP but as the manifesto of a new era in which cybersecurity has become a contest between algorithms. Organizations are advised to verify current PHP versions (8.3.36, 8.4.27, 8.5.12) and assume that AI scanners are already probing their infrastructure.
