Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.
While the software flaws have now been found and patches issued, the question remains whether enough of the internet will deploy the patches in time, before hackers start exploiting the vulnerability to attack websites and steal vital data.
Most web pages run using an open-source programming language called PHP. That language is maintained by the PHP Foundation. Today, the foundation disclosed two “critical” software vulnerabilities and issued an emergency patch, urging websites to implement it immediately or take down their websites until they are able to. The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively called “php2shell.”
