Article
PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) took 81 days to fix, but only 7 days to find and 4 days to start attacking. AI-assisted researchers found the flaw in PHP core, one researcher did in a week the work of a team for months, and the same AI that found it can now write a working exploit in 10 to 15 minutes for about one dollar. Censys counted 1.5 million of 2.6 million internet-facing PHP hosts still unpatched shortly after the fix shipped. France shut down its Interior Ministry, Meteo-France and the tax authority; the UK reported 32 government services unavailable. The Cloud Security Alliance measures mean time to exploit falling from 32 days in 2022 to 5 days in 2023, while mean time to remediate a complex enterprise application reached 5 months and 10 days. The bottleneck moved from discovery to response. Response is still human.
24 October 2026 · 9 min read