Sources · Distilled · Episode 5

Did AI Help Find PHP2Shell, a Bug in the Code Behind 7 in 10 Sites?

Every figure shown on screen in this episode, with the document, page and date it comes from, and a label for how strong the evidence is.

Two flaws in PHP, the code behind about 7 in 10 websites whose server language is known, let an attacker run commands on a web server without logging in (US agency CISA, Oct 21, 2026). Wiz, which reported them with Calif, OpenAI and Quarkslab, says the flaws sat in PHP for years and that Google's AI model Gemini 4 Argon helped find them. Fixes are out; CISA says update now or take older PHP sites

Published: 24 October 2026
Figures checked: 24 October 2026
Documents: 6

Watch the episode Jump to the documents

On screen in this episode

5The document shows it, and you can check it yourself.
3Someone says so, but nothing independent backs it up.
1Something that matters is missing from every source we checked.

How we label evidence

What isn’t shown

0:28Not shown: a count of sites actually compromised

On screen, in order

0:00
PHP is used by 69.3% of all websites whose server-side programming language W3Techs knows (spoken: about seven in ten websites)
Data as of 24 October 2026. Share of sites with a known server-side language, not of all sites.
- [1] W3Techs, intro sentence, data 24 Oct 2026
0:00
The two flaws (CVE-2026-109618, CVE-2026-109619, 'php2shell') allow unauthenticated remote code execution in PHP
Data as of 23 October 2026. Spoken in plain words: a stranger can run commands on the server without a password.
- [2] CISA alert, first paragraph
- [3] NCSC alert, summary
0:08
Wiz: 'The underlying flaws had been present for decades'; every PHP version of the last decade is affected, back to 5.4
Data as of 21 October 2026. Spoken conservatively as 'for years'. Discoverer's own account.
- [4] Wiz Research blog, introduction
0:08
Wiz: 'Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch'; Wiz also used Wiz Atlas and GPT-5.6 Sol
Data as of 21 October 2026. The excerpt shown on screen is Wiz's general statement that frontier AI models reduced the barrier; the Gemini sentence is further down the same page. Disclosure partners per Cloudflare: Calif, Wiz, OpenAI, Quarkslab.
- [4] Wiz Research blog, research notes / acknowledgements
0:15
Fixed releases PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (CISA: released for these CVEs on 21 Oct 2026)
Data as of 23 October 2026. PHP's own ChangeLog dates the releases 22 Oct 2026 while the release feed and CISA say 21 Oct; spoken date follows CISA.
- [2] CISA alert, first paragraph
0:15
CISA: organizations that cannot update immediately, or use PHP 8.1 or earlier, should take PHP-based systems offline until patched
Data as of 23 October 2026. 'old sites' = sites on unsupported PHP 8.1 or earlier, or that cannot update immediately.
- [2] CISA alert, recommended actions
0:21
Notable organizations disclosed about 1,300-1,500 high- and critical-severity CVEs in June 2026, 'more than 3.5x' the pre-Mythos monthly record (spoken: more than three times)
Data as of 2 July 2026. Epoch's page is internally inconsistent (summary ~1,300, body ~1,500, table 1,546; record ~407 in Sep 2025 by the table, i.e. 3.2-3.8x). 'More than three times' holds on every version. Causation: Epoch says almost certainly increased feasibility of discovery, possibly also more interest; spoken as timing only ('since ... arrived').
- [5] Epoch AI data insight, summary, chart and table
0:28
Cloudflare: 'we observed attack traffic targeting our customers' (no numbers given)
Data as of 23 October 2026. Company's own observation. The CEO's 'millions of attempts' figure appears only in a social post and is not used.
- [6] Cloudflare blog, body
0:28
Not shown: a count of sites actually compromised
Data as of 24 October 2026. Checked on 24 Oct 2026 in these three sources only.
- Checked[2] CISA alert, CISA: no successful exploitation observed as of publication (21 Oct, page revised 23 Oct)
- [3] NCSC alert, NCSC: no exploitation statement
- [6] Cloudflare blog, no counts

Documents

Times are seconds into the Short.
Images on screen are screenshots of the cited documents or logos; an image is not evidence by itself.

[1]
W3Techs
Usage statistics of PHP for websites
Published 24 October 2026 · Retrieved 24 October 2026
Licence: Survey page; figure used for news reporting
Used at 0:00
[2]
CISA (US Cybersecurity and Infrastructure Security Agency)
Critical Vulnerabilities in PHP Require Immediate Patching (alert, revised 23 Oct 2026)
Published 21 October 2026 · Retrieved 24 October 2026
Licence: US government work, public domain
Used at 0:00 · 0:15 · 0:28
[3]
UK National Cyber Security Centre
Critical security issue affecting PHP (updated 23 Oct 2026)
Published 21 October 2026 · Retrieved 24 October 2026
Licence: UK government page (Open Government Licence)
Used at 0:00 · 0:28
[4]
Wiz Research
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Published 21 October 2026 · Retrieved 24 October 2026
Licence: Company blog page; used for news reporting
Used at 0:08
[5]
Epoch AI
Disclosure of serious cyber vulnerabilities spiked around the release of Claude Mythos Preview
Published 2 July 2026 · Retrieved 24 October 2026
Licence: CC BY (Epoch AI)
Used at 0:21
[6]
Cloudflare
Cloudflare deploys protections against php2shell vulnerability (updated 23 Oct 2026)
Published 21 October 2026 · Retrieved 24 October 2026
Licence: Company blog page; used for news reporting
Used at 0:28

Corrections

No corrections so far.

Found an error? Email [email protected] with the time stamp and your source, or leave a comment under the video.