PHP2Shell Flaws Are Real, but Exploiting Them Still Takes Serious Skill, Test Finds

Researchers at Hacktron gave five AI models the same working exploit for php2shell, a pair of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and asked them to adapt it to an isolated, production-style MediaWiki site running behind Caddy. Claude Mythos 5.1 succeeded in 3 hours 28 minutes, and GPT-5.6 Sol in 6 hours 10 minutes. Among the open models, GLM 5.3 achieved local code execution but could not exploit the remote target after more than 20 hours. Kimi K3.1 Pro and DeepSeek V4.1 Flash never completed the first step, which is a data leak.

PHP is used by roughly 69% of websites with an identifiable server-side language, according to W3Techs, including many government, school, hospital and business sites. The flaws were found by researcher Ryan Austin of calif.io and patched with the PHP maintainers. A patch does not mean systems are protected, though, as legacy dependencies, downtime limits and limited resources can leave systems exposed for months or years.

Days after disclosure, there has been heavy scanning and many exploitation attempts, but not the mass compromise many expected. One researcher documented successful exploitation of honeypots, yet there is no convincing public evidence of attacks at scale, and neither CVE is in CISA's KEV catalog as of October 26. The author argues the bug is not overhyped: it can be exploited reliably, but each target needs its own adaptation, which demands serious skill from a human or an AI.