Attack
An Amazon honeypot recorded an exploitation attempt of the PHP2Shell flaws four days before the patch.
The two critical bugs CVE-2026-109618 and CVE-2026-109619 each have a score of 9.2 out of 10 according to CVSS v4.0.
Wiz made a report on August 24 with the help of Gemini 4 Argon, GPT-5.6 Sol and its own tool Wiz Atlas.
According to OpenAI, Calif found a critical flaw with GPT-5.6 Sol as part of the Patch the Planet program.
Cisco Talos estimates that about half of PHP systems will not receive a patch.