Weekly Tech Review: October 18–24, 2026 — AI Found a Decade-Old Hole in PHP, and Attackers Got There First

Three things dominated this week: a critical PHP vulnerability, a run of serious breaches, and the usual churn of AI announcements.

They are not three stories. They are one.

The PHP flaw had been sitting in the language for over a decade without anyone noticing. It was found this summer by security researchers pointing AI models at source code. By the time the patch shipped on 21 October, attackers were already exploiting it. That sequence — AI finds an old bug, attackers move faster than the patch cycle, defenders scramble — is the actual shape of the week.

Here is what happened, with the confirmed items separated from the reported ones.

PHP2Shell: two critical RCE flaws, patched 21 October

PHP released emergency patches on 21 October 2026 for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2. Both allow unauthenticated remote code execution — an attacker runs code on your web server without logging in, without a stolen credential, without any user doing anything wrong.

The nickname going around is PHP2Shell, and the comparison people keep reaching for is Log4Shell. That comparison is doing some work, but the severity and the breadth are genuinely in that territory.

What is affected

Essentially any PHP installation that serves web requests:

• PHP-FPM
• Apache mod_php — singled out as the highest risk
• php-cgi
• FrankenPHP
• LiteSpeed

That last one matters more than it looks. LiteSpeed is what a very large share of budget and shared hosting runs on, including most cPanel-style providers. If your site is on shared hosting, there is a good chance this list includes you whether or not you think of yourself as "running PHP".

Fixed versions

End-of-life branches get no official release, but the PHP security team published minimal source backports for 7.4 through 8.1. If you are still on 7.4 in production, this is the week that decision stops being theoretical.

A third, much smaller issue — CVE-2026-115560 — was disclosed on 23 October. It only affects web applications configured in an unusual way, PHP rates the risk as unlikely, and if you applied the 21 October patch you need to do nothing further for it. The interim advice for anyone who hasn''t is to disable session upload progress. No exploitation has been reported.

Attackers were ahead of the disclosure

This is the part worth sitting with. Amazon Threat Intelligence observed an exploitation attempt on 17 October — four days before the public disclosure and the patch. Their assessment is that the flaw is now being broadly exploited in the wild.

So the window between "someone is using this" and "you could do anything about it" was negative. There was no safe period.

One detail we are leaving open: sources disagree on whether CISA has added these CVEs to its Known Exploited Vulnerabilities catalog. One report says it had not as of 22 October; Tenable''s update the same day describes the KEV status as included. If that distinction matters for your compliance obligations, check the catalog directly rather than trusting a secondhand summary — including this one.

AI found it

Two firms, working independently, using language models.

Calif found the first flaw on 1 August using GPT-5.6 Sol, as part of OpenAI''s "Patch the Planet" programme, and reported it to the PHP security team around 11 August. Wiz Research reached the same conclusion separately using Gemini 4 Argon, GPT-5.6 Sol, and its own tooling. The PHP Foundation credited Calif, OpenAI and Wiz among others.

Wiz describes these as the most severe vulnerabilities ever discovered by AI, and estimates the affected surface at 70% of the internet. Both of those are Wiz''s own characterisations — the 70% figure in particular is their estimate and has not been independently verified. Treat it as a vendor''s framing of their own find, which does not make it wrong, but does mean it is not a measurement.

Strip the marketing off and the fact underneath is still striking. A bug sat in one of the most-read, most-audited codebases on the internet for more than ten years. Human review did not find it. Three different model-assisted efforts found it within weeks of each other.

What to actually do

1. Managed or shared hosting: check with your provider. Most patched at the platform level within a day or two — but "most" is not "yours", so get it confirmed rather than assumed.
2. Your own server, package manager: update PHP through your distribution. Do not wait for a maintenance window.
3. Your own server, compiled PHP: move to a fixed release above.
4. End-of-life PHP: apply the backport, and treat this as the forcing function to upgrade.
5. Either way, check your logs back to mid-October, not just to the disclosure date. Exploitation predates the announcement.

The breaches

Three worth knowing about, all within 48 hours.

Quest Diagnostics (23 October). The lab testing company confirmed a breach in an SEC 8-K filing. The target was Quanum, the system handling lab requests and billing for doctors'' offices and hospitals. Sensitive patient information was compromised. The company has not said how many people are affected — and in healthcare breaches that number almost always grows after the first filing.

ConnectWise (22 October). Microsoft researchers say China state-aligned hackers broke into ConnectWise''s cloud backup service and stole the application credentials that link ConnectWise to its corporate customers. The reported result is surveillance of thousands of companies.

This is the supply-chain pattern that keeps working: you do not attack thousands of companies, you attack the one piece of remote-management software they all installed and trust. The victims had no vulnerability of their own to patch.

Edge devices (23 October). The Hacker News reports a large-scale campaign against exposed network edge devices — Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls among them — with more than 70,000 credentials exposed.

The common thread with PHP2Shell: all four are infrastructure nobody thinks about daily. The language runtime, the remote-management tool, the firewall. Things that sit at the edge, run as root, and get patched last.

The AI news

Anthropic shipped Claude Duet on 21 October, which asks for approval before consequential actions — sending a message, making a purchase. Read alongside the rest of this week, the framing is hard to miss: as agents get permission to act, the interesting engineering moves to deciding what they may do unsupervised.

On 22 October, Anthropic''s Frontier Red Team published research on using Claude to formally verify security properties across open-source libraries. That is the mirror image of the PHP story — the same class of capability pointed at proving code correct rather than finding it broken.

OpenAI''s models came to Google Cloud on 21 October. Two companies competing hard at the model layer, and OpenAI distributing through its rival''s infrastructure anyway.

Also reported, with less certainty: OpenAI is said to be closing a bridge round of up to $30 billion at a $1.25 trillion pre-money valuation — notably down from the $1.4 trillion it reportedly pitched earlier, after investor resistance. And Anthropic''s IPO paperwork is reportedly becoming public, with Q3 revenue of $16.8 billion, up close to 50% from Q2. That revenue figure comes from a single report and we have not seen it in a primary document; treat it as such.

On 22 October, four projects joined the Linux Foundation''s Agentic AI Foundation at AGNTCon: Anthropic''s Agent Skills, OpenAI''s Open Responses spec, Hugging Face''s OpenEnv, and Alibaba''s OpenSandbox. Competitors standardising how agents describe their capabilities is the least glamorous item here and possibly the most consequential.

And the UK committed £100M to an AI Biosecurity Lab, with OpenAI and Anthropic each pledging up to £100M in model credits and trusted model access.

What this week actually told us

The PHP story is the one to carry forward, and not because of the patch.

A critical flaw survived a decade in code that thousands of engineers have read. Three model-assisted efforts found it in a matter of weeks. That capability is not restricted to defenders — the same models, the same technique, pointed at the same codebases, work equally well for whoever gets there first. The four-day head start attackers had on this one is a preview, not an anomaly.

The practical consequence for anyone running a website: the gap between a bug existing and a bug being exploited is collapsing, and the old rhythm of patching on a comfortable schedule does not survive it. Patch windows measured in weeks were already uncomfortable. They are now simply wrong.

If you run PHP anywhere, go and check your version. It takes a minute, and this week it is worth the minute.

---

Sources: Tenable, Wiz Research, CERT-EU, The Hacker News, Google Cloud, TechCrunch on Quest Diagnostics, TechCrunch on ConnectWise, SOCRadar.

Working with AI tools rather than reading about them? Our prompt library is free and needs no account.