php2shell: Critical PHP Flaws, Emergency Patches and the Role of AI

PHP shipped emergency patches for the critical php2shell flaws, CVE-2026-109618 and CVE-2026-109619. We look at what is known and how AI is speeding up both attack and defense.

Show Notes

AI-generated: both hosts are AI voices (Google NotebookLM), and the conversation is based on the sources listed below.

In this episode we cover php2shell, a set of critical vulnerabilities in PHP that led to emergency patches. We go through the two flaws tracked as CVE-2026-109618 and CVE-2026-109619, why the security industry treated them as a red alert, the debate over who found the bug and what ChatGPT had to do with it, and reports of governments taking websites offline while they responded.

PHP runs a large share of the web, so a critical flaw in it affects businesses and public services everywhere. Security agencies such as HKCERT are telling organizations to review and patch their PHP systems right away. They warn that AI is speeding up both cyberattacks and defense, which shortens the time between a vulnerability being disclosed and attackers exploiting it.

• What php2shell is and why PHP shipped emergency patches
• The two critical CVEs: CVE-2026-109618 and CVE-2026-109619
• Who found the bug, and the role of ChatGPT and AI in the story
• Why governments and businesses rushed to unplug or patch websites
• How AI is shrinking the window between disclosure and exploitation

Sources:

• https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws
• https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
• https://www.darkreading.com/application-security/php2shell-bugs-red-alert-security-industry
• https://decrypt.co/381567/who-found-php-bug-governments-unplug-websites-chatgpt
• https://www.hkcert.org/blog/hkcert-warns-of-critical-php2shell-vulnerabilities-businesses-must-immediately-review-and-patch-php-systems-ai-accelerates-cyber-attacks-and-defence-further-shortening-the-response-window-between-vulnerability-disclosure-and-exploitation

What is Radio Hoosh: AI Deep Dives?

Radio Hoosh takes each day's biggest AI story (a new model, a research paper, a lab announcement or a developer tool) and unpacks it in a 20–45 minute conversation. Both hosts are AI-generated voices (Google NotebookLM), and episodes are produced automatically from public sources such as Hacker News and Hugging Face Daily Papers, then published by Kasra Qasempour. "Hoosh" is Persian for intelligence; a Persian edition is available as رادیو هوش.