php2shell: was it really an ai discovery?

PHP2Shell explained: the full story of the PHP vulnerability (CVE-2026-109618, CVE-2026-109619) that took DigiD, 32 UK government services and parts of Wikipedia offline. Known since 2004, stuck for two years, proved with AI models, leaked early. Who really found it, and how to patch PHP tonight. ---- Higgsfield AI — Create AI Videos & Visuals Get 10% OFF here: https://higgsfield.ai?fpr=thomas-dccf7e 🚀 DYNAMOUS AI COMMUNITY Want to learn agentic coding with live daily events and workshops? Check out Dynamous AI: https://dynamous.ai/?code=646a60 Get 10% off here 👉 https://shorturl.smartcode.diy/dynamous_ai_10_percent_discount ⚡ HOSTINGER — RELIABLE HOSTING FOR YOUR PROJECTS (10% OFF) Whether you're shipping a portfolio, a side project, n8n flows, or AI agents — I use Hostinger for fast, affordable VPS + web hosting. Get 10% off here 👉 https://hostinger.com/DIYSMARTCODE n8n: https://n8n.partnerlinks.io/diysmartcode (Affiliate links — costs you nothing, supports the channel.) ---- Chapters 0:00 PHP2Shell: Why Websites Switched Themselves Off (DigiD, UK Gov, Wikipedia) 1:04 Where the PHP Bug Sits: Your App, the PHP Engine, the Server 1:34 Who Is at Risk: PHP-FPM, mod_php, FrankenPHP, LiteSpeed 2:12 Known Since 2004: The PHP Memory-Limit Bug History 2:47 Why the PHP Fix Stalled for Two Years 3:15 Who Found PHP2Shell: Calif, OpenAI GPT-5.6 Sol, Wiz, Gemini 4 Argon 3:48 Claude Mythos Scan vs the Researcher Who Knew Where to Look 4:28 The Leak: Amazon Honeypot, Wrong CVSS 10, Embargo Broken 6 Hours Early 5:25 Release Day: Cloudflare WAF, CISA and NCSC Say Take PHP Offline 5:57 Was PHP2Shell Exploited? CISA vs watchTowr vs Amazon 6:53 How to Patch PHP2Shell: 8.5.12, 8.4.27, 8.3.36, 8.2.35 + Restart Workers 7:28 Temporary PHP Mitigations (If You Can't Update Tonight) 7:49 PHP 8.1 and Older, the 73.5% Scan, PHP 8.2 End of Life 8:30 After the Patch: Investigate From October 17 8:59 Shared Hosting, WordPress.com, Nextcloud on a NAS 9:29 Is PHP2Shell Overblown? 70% of Websites vs 70% of the Internet 10:16 Verdict: Update, Restart, Check the Version Our Short on OpenAI's side of PHP2Shell: https://www.youtube.com/shorts/6vaikBzAP2Y PHP Foundation: today's PHP security release and how PHP security is changing: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ PHP security release (php.net): https://www.php.net/archive/2026.php PHP supported versions (8.2 end of life): https://www.php.net/supported-versions.php Calif: PHP2Shell write-up: https://calif.io/php2shell Wiz Research: PHP2Shell write-up: https://www.wiz.io/blog/php2shell-php-rce OpenAI: coordinated disclosure of critical vulnerabilities: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ Amazon Threat Intelligence: exploitation before public disclosure: https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/ CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching UK NCSC: critical security issue affecting PHP: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php Cloudflare: WAF protection for PHP2Shell: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ watchTowr: PHP2Shell FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/ Automattic: WordPress.com sites are protected: https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/ Nextcloud forum: is Nextcloud affected?: https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255 Mallory: PHP version scan (corrected 21 Oct): https://mallory.ai/blog/php-rce-rapid-response W3Techs: PHP usage statistics: https://w3techs.com/technologies/details/pl-php The Register: PHP2Shell puts dozens of UK government services out of service: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840 NOS: websites taken offline over the PHP leak (Dutch): https://nos.nl/artikel/2636055-steeds-meer-websites-offline-gehaald-vanwege-lek-risico-op-hacks NBC News: critical PHP vulnerabilities: https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751 So who found PHP2Shell: the model, or the human who knew where to look? Pick a side below. #PHP2Shell #PHP #PHPVulnerability #PHPSecurity #CyberSecurity #InfoSec #WebSecurity #WebsiteSecurity #WordPressSecurity #WordPress #Laravel #Drupal #Nextcloud #RemoteCodeExecution #RCE #CVE #PatchNow #AISecurity #OpenAI #Wiz #Cloudflare #CISA #DevOps #SysAdmin