EDITION OF OCTOBER 24, 2026
PHP2Shell: patches are available, but exposure persists
TechCrunch describes PHP flaws that allow remote takeover without authentication. Patches were released on Wednesday, following confidential preparations with major web companies. The risk persists for unpatched systems, according to the researchers cited.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
The response to PHP2Shell illustrates a central challenge in web security: making a patch available is not enough to protect every system. TechCrunch's account describes a coordinated disclosure, service interruptions and an AI contribution whose limitations the researchers emphasize.
Patches are available for PHP2Shell, but deploying them remains the decisive step. In its article published on October 24, TechCrunch reports that systems remain vulnerable despite prior coordination between PHP maintainers and major web companies. The flaws allow unauthenticated remote code execution on affected, unpatched systems.
Designated CVE-2026-109618 and CVE-2026-109619, these vulnerabilities can be exploited without the victim clicking a link or opening a file. According to the outlet, they can give an attacker control of the affected system, with the ability to install malware, steal data or maintain persistent access. This combination explains the urgency of deploying the patches.
TechCrunch says the flaws had been identified in 2024 but were not considered exploitable at the time and were not patched at that stage. Calif researchers subsequently found ways to exploit them and alerted the PHP Foundation. The foundation organized a coordinated disclosure, confidentially sharing information and patches with major companies so they could prepare to deploy them.
The public patches were released on Wednesday, according to the outlet's account. Banks, retailers, gaming services, hospitals and public agencies temporarily took their websites or servers offline to carry out the work. TechCrunch assesses that this preparation has largely helped prevent widespread exploitation so far, while relaying researchers' warnings about systems that remain exposed. This provisional assessment therefore does not establish that the risk has disappeared.
The case also has an artificial intelligence dimension. Calif was participating in OpenAI and Wiz's Hack the Planet initiative, and the two companies verified its exploit demonstrations, TechCrunch reports. According to the researchers' account presented by the outlet, AI helped exploit the flaws, but most of the work relied on their knowledge of PHP code and its security history.
The operational lesson thus lies in moving from an available patch to an installed patch. Coordination can reduce initial exposure, but it does not guarantee that all affected systems are protected. As for AI's role, the reported evidence describes assistance with specialized work; it does not demonstrate a general ability to discover and exploit all vulnerabilities automatically.