PHP2Shell Bugs Hit PHP as Wiz Warns of AI Vulnerability Flood
Two critical PHP2Shell bugs threaten a language powering roughly 70% of websites, as Wiz warns AI will accelerate vulnerability discovery and exploitation.
Summary
Two critical PHP2Shell bugs emerged in the week before October 28, 2026, affecting PHP, the open source language behind roughly 70% of websites. Organizations rushed to patch systems, and some took sites offline until fixes could be applied.
Google-owned Wiz worked with OpenAI, research group Calif and the PHP team on the response. Tomer Schwartz, Wiz CTO of Exposure Management and AppSec, participated in the effort and discussed how early-stage startups can build with security in mind. Researchers who found the flaws warn that AI is accelerating both discovery and exploitation of novel vulnerabilities, making this episode an early warning of a broader “vulnpocalypse.” Cleanup remains unfinished, and manual patching will not scale as vulnerability volumes and exploitation speeds increase.
Positives
- Google-owned Wiz, OpenAI, Calif and the PHP team collaborated on fixes for the two critical vulnerabilities.
- Some organizations took affected websites offline until patches could be applied rather than leave vulnerable systems running.
- Tomer Schwartz outlined how early-stage startups can build products with security in mind.
- AI is increasing the speed at which researchers can uncover novel vulnerabilities.
Risks & concerns
- Two critical PHP2Shell bugs forced organizations to scramble for patches and temporarily disable some websites.
- PHP powers roughly 70% of websites, giving critical flaws potentially extensive reach.
- AI can accelerate exploitation as well as discovery, shrinking the time available for defenders to respond.
- Manual patching will not scale if the number and speed of newly discovered vulnerabilities continue rising.
- Cleanup was still incomplete on October 28, 2026, with further remediation details limited.