This week gave me Heartbleed vibes again, a vulnerability that haunted everyone for years. PHP powers 70% to 80% of the internet's websites, including widely popular CMS platforms like WordPress and Drupal. Critical PHP RCE (Remote Code Execution) vulnerabilities, registered under CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell", were leaked online before the official announcement for security patches took place. In fact, some threat actors attempted to exploit them up to four days before the PHP Foundation officially released patches for PHP versions 5.4 to 8.5.
What will make this situation worse in the coming months and years is the sheer number of legacy systems that cannot be updated. This happens for several reasons: the operating system or dependencies has reached its end of life, the software solution was discontinued and left unmanaged, or the sole person managing a fragile system left the company. Often, because a system still generates high profits, no one has dared to update it in years, leaving it hanging as low-hanging fruit for an easy compromise. Many organisations face a combination of these exact issues and many more.
Furthermore, typical patching cycles require a week or two of piloting to monitor for instabilities or system crashes. Companies are naturally reluctant to skip this testing phase, but the severity of this PHP vulnerability means standard patching cycles must be expedited immediately.
As AI makes waves across every IT and Cyber Security sector, the threat landscape is shifting massively. We are now seeing threat actors use AI to reverse engineer solutions and compromise systems before security patches are even available. Years ago, before AI became a mainstream trend, this level of speed would have been unimaginable. Yet, as with every technological advancement and revolution, here we are.