The internet is currently experiencing a significant security crisis, with a wave of critical vulnerabilities being reported in rapid succession over the past 48 hours. At the center of this storm is PHP2Shell, but it is not the only major flaw to emerge, prompting widespread concern and a notable spike in exploitation attempts. Cloudflare CEO Matthew Prince observed "thousands of attempts to exploit" the PHP vulnerability in the ten hours before its public announcement, a number that rapidly escalated to millions shortly after.
This concurrent emergence of vulnerabilities is not a coincidence, but rather a consequence of advancements in artificial intelligence. Wiz Research, one of the teams that discovered the PHP vulnerability, noted that AI "reduces the effort needed to develop and adapt complex exploits," making previously impractical vulnerabilities viable targets. This represents a double-edged sword where AI enhances the ability to find and fix bugs, but also significantly improves the tools for exploiting them.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
PHP, a widely used scripting language that powers an estimated 70 percent of websites, is at the heart of the most pressing vulnerability. PHP2Shell is actually a pair of vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both enabling Remote Code Execution (RCE). RCE allows attackers to run code on a target system without permission. Due to the widespread use of PHP, the United States' National Security Agency and the UK's National Cyber Security Centre advised websites to go offline until patches were available.
The gaming industry has not been immune to the fallout. Square Enix has confirmed "unauthorised access" to its systems, multiple Pokémon apps required emergency offline maintenance, and two of Japan's oldest mobile games are being permanently shut down as a direct result of the PHP vulnerability.
GitLab (CVE-2026-110264)
Another critical RCE vulnerability, CVE-2026-110264, was reported in GitLab, a popular Git repository manager. Rated a 10 out of 10 on the Common Vulnerability Scoring System (CVSS) scale, this flaw is considered more severe than PHP2Shell's 9.2 rating. The National Vulnerability Database indicates that CVE-2026-110264 has a low complexity threshold, making it easier to exploit. The vulnerability reportedly affects GitLab versions prior to 7.0, and users are strongly advised to upgrade immediately.
Plex2Shell (Multiple CVEs)
Plex, the media streaming service with over 42 million subscribers, also experienced a series of severe vulnerabilities, collectively known as Plex2Shell. While these were reported by Plex in early September, the specific CVEs were released on October 20: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. These four vulnerabilities combine to allow for RCE. Although patched by Plex, the company observed multiple attacks over the past month, with compromised servers being used to run cryptocurrency miners and proxy software, routing other users' traffic through the victim's connection.