Decade-old PHP bug puts websites at risk: How AI uncovered it, who is vulnerable and how to stay safe | Explained

PHP2Shell is a pair of critical flaws in PHP’s core engine, CVE-2026-109618 and CVE-2026-109619, that could let attackers run code remotely and steal data without logging in. Wiz Research found them using AI models; Amazon spotted attacks before disclosure. Here’s how they work and who is at risk.