By Alex Woodie
Publication Date: 2026-10-26 04:05:00
October 26, 2026
Alex Woodie
AI helped uncover a pair of critical security vulnerabilities in PHP that can be used to execute code, including on IBM i servers, sent administrators around the world scrambling to install patches on a large swath of the Internet’s Web servers before cybercriminals can get to them. The flaws, along with the rapid dissemination of AI-based exploit code, led some organizations to simply unplug their websites, earning the whole episode the name “Black October.”
On October 21, patches for two critical security vulnerabilities in PHP were released. The two vulns, CVE-2026-109619 and CVE-2026-109618, collectively called PHP2Shell, each garnered a 9.2 on the Common Vulnerability Scoring System (CVSS) rating system, as they can be exploited to allow unauthenticated attackers to run arbitrary code and steal data from impacted systems by sending a…