Over the past week, a critical security incident has spread across the web, and it belongs on the board agenda. Two vulnerabilities in PHP, the engine behind nearly 70% of all websites, allow an attacker to take control of an affected server without logging in. The flaws are known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) are rated 9.2 out of 10. What makes them significant to the leadership is how they came to light. Artificial Intelligence found them, and AI is now helping attackers exploit them faster than before.
Part of the underlying flaw was not new. In 2024, a PHP core developer flagged the out-of-memory error behind it during an audit. Nobody could show that it could be exploited, so it was never prioritised.
That changed in August 2026. A researcher at a security firm used the GPT-5.6 Sol model to turn that dormant weakness into working remote code execution. Other researchers reached the same result independently with Gemini 4 Argon, GPT-5.6 Sol and their own tooling. Experienced specialists still guided the AI at every step. AI did not create a new kind of threat. It shortened the road from suspicion to proof!
That shorter road is open to attackers as well. Amazon's threat intelligence recorded exploitation attempts from 17 October, four days before the flaws were made public. Cloudflare then saw millions of attempts within hours of publication. Palo Alto Networks Unit 42 described an intrusion at a European government body that bore the hallmarks of an agentic AI attacker, although it has since said it cannot confirm that PHP2Shell was how the attacker got in.
The PHP project released emergency patches on 21 October 2026 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). Two days later, a third, related flaw (CVE-2026-115560) was disclosed, and those releases do not fix it. Organisations should therefore expect further updates and treat remediation as a short campaign rather than a single action. The business stakes are clear: data theft, onward movement into connected systems and disruption of revenue-generating platforms. Several European governments, including the Dutch portal Overheid.nl, took websites offline as a precaution.
PHP2Shell arrived just as we were discussing this very challenge with customers. In recent weeks, Noventiq and AWS hosted two executive roundtables under the banner "From Reactive to Predictive". The first was a dinner in London with CISOs, CIOs and security leaders from Financial Services and ISV organisations. The second was in Amsterdam, where CISOs and security leaders explored how AI can future-proof security operations. AWS security specialists contributed to both evenings.
Looking back, those conversations read almost like a commentary on this incident. Participants agreed that the AI-accelerated threat landscape is making legacy, perimeter-based security models obsolete, and that alert-driven defense must give way to proactive security built on AI and automation. They stressed the need to uncover hidden attack surfaces, which is exactly the challenge of finding every PHP instance in a sprawling estate. They also discussed what separates organisations that recover in hours from those that take weeks: mature response and recovery capabilities, rehearsed well before they are needed.
In Amsterdam we asked one simple question. If you could focus on only one area over the next twelve months (cloud security posture, AI governance or incident response readiness), which would you choose? The answers varied widely, and rightly so, because there is no single playbook. PHP2Shell, however, touches all three.
In practice, a predictive approach starts with visibility: knowing where PHP runs across your infrastructure whether that is on AWS, Azure, Google Cloud or in your own data centres. The patched releases then need to go onto every affected system. While that work is under way, on AWS, for example, virtual patching can be delivered through AWS WAF: Amazon has published an updated managed rule group that acts as a virtual patch for one of the two flaws, supplemented by custom rules that cap request sizes and curb repeated probing attempts. However, a firewall narrows the attack surface, but … it does not replace the upgrade or server-level hardening!
This is also where the question raised in both cities becomes very practical. Should you carry the 24/7 operational burden in-house, or share it with a managed security partner that can patch, monitor and respond around the clock?
PHP2Shell is serious but fixable. Confirm three things: the patches are applied, edge and server-level mitigations are in place, and your teams can respond as further fixes arrive. Then ask the strategic question: if AI can turn yesterday's dormant bugs into today's emergencies, is our security truly predictive? Our Managed Services team can carry out a rapid cross-cloud exposure assessment and manage remediation for you. Contact us today to confirm your estate is protected.
Explore customer success stories and industrial use cases from the AWS Partner Network and Noventiq.
👉 Book your meeting to discuss your potential next step