Critical PHP Flaws Are Real, But Turning Them Into Attacks Still Takes Serious Skill

A pair of critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell, has caused alarm worldwide. PHP runs a large share of the web: W3Techs puts it at roughly 69% of websites with an identifiable server-side language, including many government, school, hospital and business sites. The flaws were found by researcher Ryan Austin of calif.io and patched with the PHP maintainers, but a patch does not mean systems are protected. Legacy dependencies, downtime limits and lack of resources can leave some systems exposed for months or years.

Days after disclosure, there has been plenty of scanning and many exploitation attempts, but not the mass compromise many expected. One researcher documented successful exploitation against honeypots, yet there is no convincing public evidence of attacks at scale, and neither CVE was in CISA's Known Exploited Vulnerabilities catalog as of October 26. Some have called the issue overhyped. Hacktron's author disagrees: the bug is real and can be exploited reliably, but each target needs its own adaptation, which takes real skill.

To test this, Hacktron gave five AI models a working exploit and asked them to port it to an isolated MediaWiki deployment behind Caddy. Claude Mythos 5.1 captured the flag in 3 hours 28 minutes and GPT-5.6 Sol in 6 hours 10 minutes. Among open models, GLM 5.3 achieved local code execution but could not exploit the remote target after more than 20 hours, while Kimi K3.1 Pro and DeepSeek V4.1 Flash never reached the first step. This is only the opening of the research, and the full analysis goes further.