How AI is disrupting cybersecurity

On October 21, the PHP Foundation, the non-profit organization behind the PHP programming language, announced two security vulnerabilities with the code CVE-2026-109618 and CVE-2026-109619 (collectively known as PHP2Shell) that exist on the platform with an update. Both have a very high severity level of 9.2/10 points, meaning they can help hackers execute remote code and run malicious commands on the affected server.

Speaking to WSJ, Mr. Duong Ngoc Thai, CEO of Calif Research, said the PHP2Shell vulnerability has been lurking in the PHP source code for many years, but is too difficult to exploit and has largely been forgotten. But it was AI that figured it out.

PHP and PHP2Shell vulnerability

According to BBC, many common users may not have heard of PHP (Hypertext Preprocessor) but actually use it every day. It is an open source web server-side programming language, developed in the early 1990s to support dynamic websites and applications.

When a user visits a website, PHP is the code that collects data and converts them into a readable page. Although there are many new and more highly rated programming languages, PHP is still the power foundation of most global website systems, including websites that use content management systems such as Drupal, Joomla and WordPress. According to W3Techs statistics, PHP is used on 69.3% of all active websites in the world, with version 8 accounting for an overwhelming 65.3%.

This programming language is also used to write many tools to build or speed up the process of creating web applications, with Laravel and Symfony being popular PHP frameworks. Additionally, it also integrates with vendor devices, web server control panels like cPanel and Plesk, and several Windows applications.

PHP is maintained by the PHP Foundation, made up of individuals and companies that depend on the language, aiming to ensure "long-term prosperity".

However, everything is threatened by security vulnerabilities CVE-2026-109618 and CVE-2026-109619. Both allow hackers to remotely execute code on any PHP server without authentication, creating conditions for bad guys to steal data and read sensitive information.

According to CNBC, the vulnerabilities have existed for a long time, at least two years ago. Mihail Kirov, then an employee of the cybersecurity company Quarkslab (France) and now a product security engineer at Tolmo (USA), said his team had found a vulnerability with the same root cause as PHP2Shell since 2024. "Immediately, we notified the PHP Foundation, but the patch was never deployed until a few days ago," Kirov told CNBC.

In an October 21 blog post, the PHP Foundation acknowledged the delay as a "structural failure", caused by the security team's decision-making process and lack of resources.

However, Kirov believes that the delay in patching the vulnerability is understandable when the risk of actual exploitation has not yet existed. The proof is that in the past two years, this weakness has not been exploited by hackers.

"That was when large language models were not as popular as they are now," Kirov continued. "The emergence of AI has proven that, in 2026, things happen very quickly, allowing everyone to explore many aspects of cybersecurity in different ways."

With AI, the threat continues

The US National Security Agency (NSA) warned millions of organizations to immediately install patches or take servers offline. Many government organizations and businesses also proactively "close" websites or platforms to prevent incidents. France, the Netherlands, Denmark, Australia, Japan, England, Singapore... all recommended considering temporarily suspending service provision if necessary to minimize risks.

Matt Suiche, a researcher at cybersecurity startup Tolmo, said this level of urgency is "very new." "Even a year ago, such a situation never existed," he said. "What makes things so urgent now is that everyone has AI-enhanced capabilities, not just defenders but attackers as well."

Industry experts assess that the cybersecurity game has been completely turned upside down since Anthropic announced the Mythos model earlier this year. After that, a series of companies such as OpenAI, Google, Meta... introduced similar features.

"The models are ready, including for bad guys," commented Neatsun Ziv, CEO of network security solution provider Ox Security. "In the past, it took hackers several weeks to find a new security vulnerability, and several more months to try to exploit it across the entire Internet. That time has been reduced to days, even hours starting in the Mythos era."

Speaking to TechTarget, security research firm Palo Alto Networks said it has identified more than 22.6 million servers potentially vulnerable to PHP2Shell. Similarly, the Cloudflare platform records a large number of mining attempts. "The number skyrocketed to tens of thousands within 45 minutes after the announcement, hundreds of thousands within 2 hours, and is now up to millions," Cloudflare CEO Matthew Prince wrote on Twitter on October 22.

Also on Twitter, Peter Steinberger, the "father" of OpenClaw, assessed that the vulnerability would still "cause chaos" this week, as businesses and website administrators using PHP rush to implement the necessary patch.

According to cybersecurity researcher Salil Kanhere from UNSW Sydney, attempts to exploit PHP2Shell-related vulnerabilities will continue in the coming weeks, as the technical details have now been made public. He believes that modern software is extremely complex. Some vulnerabilities may not be discovered for years even though they are still there. When you have powerful enough tools, everything will be exposed.

"With the help of AI, hackers will find new loopholes. It's just a matter of time," he shared with BBC.

Justin Timothy, a threat consultant with security research and intelligence group GuidePoint (GRIT), emphasized that hunting for early signs is extremely important, but platform administrators need to guard against future risks. "There are currently no signs that the vulnerability has been compromised on a large scale. However, a 'clean' result does not mean that the possibility of compromise has been ruled out," he told TechTarget.

"A company only knows that its system has been compromised when the data is later sold online," Ox Security's Ziv also said.

Patched PHP versions include 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For out-of-support versions 7.4, 8.0, and 8.1, the fix is ​​provided in source code; Older versions (7.3 and earlier) are not patched and need to be upgraded. According to Tolmo's Matt Suiche, PHP is an old server language, so the PHP websites of many city governments in the US "have not even been updated in the past 10 years".

The fact that AI helps find serious security vulnerabilities is reminiscent of previous cybersecurity warnings from experts. In mid-October, billionaire Bill Gates assessed that cybercriminals could use advanced AI models to disrupt the financial system and blackmail businesses. Microsoft CEO Satya Nadella also called for the need to develop advanced AI with independent monitoring mechanisms and isolation capabilities, and proposed an "emergency brake" button. Anthropic predicts the AI ​​model will "soon replicate itself in the next few months" and could cause serious damage to cybersecurity.

In Vietnam, BuiltWith statistics show that 143,000 active websites use PHP. Vietnam's National Cyber ​​Security Association assesses that PHP is currently widely used, but the risk of affecting each system depends on many factors, such as the PHP version in use or the website deployment model.

"The important thing is that the patch is ready, service providers have begun to respond, organizations have enough information to act. The priority now is systematic review, patching in the right order and continuous monitoring, instead of worrying too much," said the Association representative.