EU agencies urge urgent action after AI-assisted PHP2Shell vulnerabilities emerge
EU cybersecurity agencies have urged organisations to patch two critical PHP vulnerabilities that can allow remote code execution without authentication. The warning follows the early disclosure of the flaws, known as PHP2Shell, which prompted organisations and governments to take vulnerable websites offline while preparing security updates.
Two critical vulnerabilities in PHP, discovered with the help of advanced AI models, have prompted an urgent response from European cybersecurity authorities. In a joint statement published on 21 October, the European Commission’s Directorate-General for Communications Networks, Content and Technology (DG CNECT), the European Union Agency for Cybersecurity (ENISA), CERT-EU, Europol’s European Cybercrime Centre (EC3) and the EU network of national computer security incident response teams called on organisations to secure affected systems immediately.
Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws are collectively known as PHP2Shell. They could allow attackers to execute malicious code remotely on vulnerable servers without authentication. The PHP project released security updates on 21 October after details of the vulnerabilities emerged publicly the previous day.
The disclosure triggered precautionary measures beyond the EU agencies’ warning. Some organisations temporarily took websites offline while assessing their exposure and applying fixes. ICANN, for example, temporarily disabled three websites running PHP before restoring them after applying and testing the patch. Its separate application publication and statistics website and TLD Application Management System remained available because they do not rely on PHP.
The vulnerabilities also raise concerns about software dependencies that may not be immediately visible to users or system administrators. Commercial and open-source products can include PHP components even when their use of the language is not apparent. The EU agencies therefore recommend identifying PHP-based applications, checking with hosting and service providers, prioritising internet-facing systems and isolating exposed applications from public networks when immediate patching is not possible.
The discovery process has also drawn attention to the growing role of AI in cybersecurity research. Researchers used advanced AI models to develop an exploit for a previously identified theoretical flaw, helping reveal how it could be used in practice. The same capabilities that assist security researchers in identifying weaknesses can also help attackers develop exploits.
The incident highlights the challenge of securing widely used software when a vulnerability affects the underlying technology rather than an individual website. Remediation depends not only on releasing a fix, but also on ensuring that organisations, service providers and software vendors identify affected systems and apply it promptly.
The EU agencies said they would continue monitoring the threat and sharing information through their respective advisory channels. Organisations can consult the PHP security advisories, ENISA’s advisory and the NCSC-NL repository on potentially affected third-party software.
The joint statement also draws attention to the EU Cyber Resilience Act. Since 11 September 2026, manufacturers have been required to report actively exploited vulnerabilities through the Act’s Single Reporting Platform. Its main cybersecurity requirements are due to apply from 11 December 2027, including obligations relating to secure product design and vulnerability remediation throughout the product support lifecycle.
