Around 70% of websites rely on PHP. Researchers discovered 2 critical vulnerabilities that could have allowed hackers to access affected servers and steal sensitive data.
This situation forced organizations around the world to update their systems to protect them from potential attacks. The researchers who found the bugs believe this could be only the beginning, as AI makes it easier to discover vulnerabilities.
Tomer Schwartz, CTO of Exposure Management and AppSec at Google-owned Wiz, worked with researchers from OpenAI, Calif, and the PHP team to fix the bugs. In an episode of TechCrunch’s Equity podcast, he told Rebecca Bellan that many people took part in the research. “Calif was the first to report the bugs to the PHP team”, Schwartz said.
Wiz’s CTO explained how the teams worked together to address the problem, how startups can build security into their products, and why security teams may struggle to keep up if hackers can exploit vulnerabilities faster than security teams can patch them. Schwartz also advised startups to design their systems so they can be updated quickly and with minimal disruption.
The concern goes beyond PHP. Many technologies are maintained by small teams that lack the resources to identify and fix security flaws quickly. If AI helps uncover bugs faster than developers can catch them, attackers may have opportunities to exploit those weaknesses.
Companies should support the open-source projects they depend on, report vulnerabilities and give maintainers enough time and resources to fix security problems. They should also make sure their own systems can be updated quickly when security patches become available.
Companies need to take software security seriously. According to iMasters, the 2 PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve memory-management flaws in PHP during web requests. These flaws could let attackers run malicious code on a server remotely, without log in, potentially exposing sensitive information or giving them control of the affected system.
The vulnerabilities affect PHP 8.5.11 and earlier, 8.4.26 and earlier, 8.3.35 and earlier, and 8.2.34 and earlier. The PHP team released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, respectively. Users should install the fixed release for their version of PHP.
Those who still run PHP 8.1 or older should check whether their hosting provider has supplied a security fix or upgrade to a supported version. These older releases don’t receive regular updates from the PHP project.
Companies should regularly audit their software and IT systems. All the updates should be installed as soon as they become available.
According to Reuters, the PHP Foundation had one full-time employee and 14 mostly part-time contractors in October 2026.
The PHP2Shell incident shows how much companies depend on software maintained by relatively small teams. Businesses should not treat open-source software as free infrastructure while leaving its developers to carry the responsibility for keeping it secure. They should contribute financially and help ensure that the projects they rely on have the resources to fix future security vulnerabilities.
Technical executives play a huge role in cybersecurity. CTOs must ensure that security is built into software development and that systems can be updated quickly. Meanwhile, the right CISO needs to know how to identify the most serious risks and work with engineering teams to address them.
As AI makes it easier to find security flaws, companies will also need leaders with strong technical knowledge of application security, cloud infrastructure and software development.
