Is this the new cyber normal?

The past week has witnessed a wave of severe and critical software vulnerabilities impacting thousands of major websites, causing widespread panic among users. Understanding the current state of software security requires a grasp of these recent bugs. While I am not a cybersecurity expert, I will provide an overview of the situation by linking to external explanations.

Two separate security teams, one from California's Calif (as part of OpenAI's "Patch the Planet" program) and another from Israeli-U.S. cloud security company Wiz (part of Google Cloud), discovered two Remote Code Execution (RCE) bugs in PHP. These vulnerabilities were detected using frontier AI models, specifically GPT-5.6 Sol/Gemini 4 Argon.

Interestingly, one of the bugs (CVE-2026-109618) had been identified in a 2024 PHP Foundation security audit funded by the Sovereign Tech Agency, but it was disregarded due to the lack of a viable exploit at the time.

The PHP2Shell vulnerability, as it has been dubbed, is estimated to affect up to 70% of the internet, including websites from Wikimedia Foundation to DeviantArt, UK government, Japanese banking systems, and BBC's The Traitors program. Despite previous vulnerabilities being found, they typically did not result in widespread server shutdowns. So, what is causing this current frenzy?

To better understand the issue, let's examine the original post from the PHP Group. A user named petecooper posted about the CVEs on Hacker News, unaware of the embargo. This, along with other leaks, led to an urgent statement from the PHP Group and the release of the patch earlier than expected. However, the patch was not available until the following day.

The news of the PHP2Shell vulnerability spread rapidly, causing panic among users. Even though the vulnerability was discovered by "responsible security researchers" from "respectable companies," the patch was already being exploited in the wild within hours of its release. The PHP Foundation blamed Calif and Chainguard, alleging that Calif leaked a video of the exploit in action while Chainguard released fixes prematurely.

The timeline is complex, but multiple interconnected factors seem to have contributed to the rapid dissemination of this vulnerability.

The debate about AI's role in revolutionizing computer security continues. While some argue that AI is a game-changer, others contend that it simply makes it easier to create exploits, some of which may be flawed. Nevertheless, the real question remains: how can we differentiate between genuine vulnerabilities and AI-induced slop?

Governments worldwide have also rushed to release urgent announcements, causing users to panic. This may be due in part to governments' growing reliance on PHP and the inherent insecurity of the language. Regardless, the severity of the PHP2Shell vulnerability is undeniable, and the rapid transition from discovering a vulnerability to seeing sophisticated, automated attacks exploiting it has shortened from weeks or months to mere hours or minutes.