PHP2Shell flaws expose 22M servers to unauthenticated RCE

Summary

The ABC News segment reported on a cybersecurity emergency triggered by two critical vulnerabilities in PHP, the scripting language powering roughly 70% of identifiable websites. It described websites in the US and Europe going dark as owners rushed to apply emergency patches after the FBI highlighted risks of remote code execution and data theft. Expert Sherid Degrio from Palo Alto Networks' Unit 42 explained the flaws in PHP's memory management and error handling, confirmed OpenAI's view of the issue's severity, and outlined patching steps and resilience planning.

Sourcing drew from the FBI advisory, OpenAI statements, and Palo Alto telemetry showing 22 million exposed instances. The interview emphasized using AI defensively against future AI-driven vulnerability discovery while stressing the need for human security experts. It framed the event as the new normal of high-velocity disclosures amid accumulated technical debt.

Editorial Assessment

The broadcast accurately conveyed the scale and urgency of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which were discovered with frontier AI models and patched after a coordinated two-month effort. Viewers receive a clear call to action on patching and monitoring for compromise, aligned with advisories from the PHP Foundation, CISA, NSA, and FBI. However, the segment omits that older PHP versions (pre-8.2) lack official patches, leaving a long tail of systems exposed for months or years, and that exploitation attempts began before the official release due to an early leak. Framing as a broad 'cyber emergency' with sites 'going dark' is directionally correct but slightly overstated—many outages were precautionary rather than the result of active breaches. The discussion on 'AI policing AI' adds forward-looking balance but could have noted that AI also accelerated exploit development. Overall, a responsible public-service explainer that equips viewers with actionable steps while highlighting systemic issues in open-source maintenance.