PHP2Shell was only the beginning: AI is accelerating the patch race

The story of PHP2Shell is just the beginning of an escalating battle in the open-source ecosystem. This security flaw, caused by two newly disclosed PHP vulnerabilities, prompted government websites and public services across Europe to go offline as organizations scrambled to mitigate the risks. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow remote code execution (RCE) and expose sensitive information in process memory, affecting every PHP version back to 5.4.

The PHP project quickly released fixes for all supported versions on October 21, but the larger issue remains: approximately 40% of PHP users run unsupported PHP. This is particularly concerning as AI has exponentially accelerated the discovery of CVEs, leading to an ongoing race between vulnerability discovery and patch deployment.

AI is changing the economics of vulnerability research, making difficult security research more accessible. OpenAI's Patch the Planet initiative identified several significant vulnerabilities using GPT-5.6 Sol, posing new challenges and dangers to the open-source community. While upgrading is the recommended solution, the operational reality of moving to a new runtime can be complicated and time-consuming, especially for critical applications that rely on EOL PHP versions.

The collaborative effort of the PHP Ecosystem Security Team, the PHP Foundation, and release managers has been instrumental in ensuring critical applications remain secure during this transition. However, the race between vulnerability discovery and patch deployment shows no signs of slowing down, making it imperative for the open-source community to adapt and improve their practices to stay ahead of emerging threats.