PHP2Shell: PHP patches two critical flaws that researchers found with AI

TL;DR

• On 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a server without a login.
• Calif and Wiz reported them in August with the help of GPT-5.6 Sol and Gemini 4 Argon, and OpenAI reported the same root cause independently; the three accounts of who found what differ on the dates.
• The CVE numbers leaked on 20 October, Amazon saw an exploit attempt dated 17 October, and php.net says updating is the only complete fix.