AI Turns Parked PHP Bug Into 9.2-Rated Remote Code Execution
Image
Global – October 31, 2026 -- A PHP vulnerability that stalled in triage after a 2024 audit became unauthenticated remote code execution this year once researchers applied frontier AI models, and both PHP2Shell CVEs now carry a CVSS v4.0 score of 9.2.
PHP Foundation admits a 2024 finding stalled for lack of a proven exploit
A 2024 external audit led a PHP core developer to the first signs of an out-of-memory problem, according to the PHP Foundation's account of CVE-2026-109618. An exploit was theorized, but no one found a concrete attack vector. Each candidate fix carried a cost: a compatibility break, new denial-of-service potential, or changes to third-party extensions that seemed impossible to coordinate. Work on the fix stalled and restarted for months.