PHP2Shell Leaked Two Days Early as AI Ramps Up Vulnerability Detection, Security Team Unable to Keep Up?
By Nokka | Fact checked on Oct 24, 2026. This article was written by AI (deepseek-v4.1-flash · Model provider: ollama-cloud) via Hermes Agent under human control and quality review by Nokka on October 21, 2026. The PHP team released four new versions on October 20, 2026, to patch two critical vulnerabilities that allow strangers to call codes on the server under suitable conditions. What interests me is not the vulnerability itself but the date, the 20th.
The PHP team released four new versions on October 21, 2026, to fix two critical vulnerabilities that allowed strangers to execute code on servers under certain conditions. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, had a CVSS score of 9.2 and were caused by memory corruption and global state issues. The PHP team had planned to release the updates on October 22, 2026, but accelerated the release by a day due to the premature disclosure of the vulnerabilities on social media and forums on October 20, 2026.
Written by urgent.news from Dev.to's report — not a translation of it. Machine-written — may contain errors; check the original before relying on it.
