Arcticwolf Critical PHP2Shell Vulnerabilities Exploited Using AI Tools
Article Content
- •Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed on October 21, 2026.
- •Exploitation attempts began immediately after disclosure, affecting government entities worldwide.
- •AI tools are being leveraged by attackers to exploit these vulnerabilities rapidly.
On October 21, 2026, two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP were disclosed, allowing attackers to execute commands on affected systems. The vulnerabilities were identified through advanced AI models, prompting immediate action from governments and organizations to apply security updates. However, exploitation attempts began almost immediately after the vulnerabilities were disclosed, with evidence of active exploitation against government entities. The vulnerabilities are critical, with a CVSS score of 9.2, and were added to the CISA KEV list on October 26, 2026. Security experts emphasize the need for organizations to enhance their cyber resilience and preparedness against such rapid exploitations. The incident illustrates the dual-edged nature of AI in cybersecurity, aiding both vulnerability discovery and exploitation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track Emotet and CVE-2026-109618 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
What are the CVEs associated with this incident?
How urgent is the response to these vulnerabilities?
Who is affected by these vulnerabilities?
Continue Reading
ConnectWise App Identities Compromised, Microsoft 365 Tenants Breached On October 19, 2026, threat actors exploited an unpatched OS command injection vulnerability in SiteGuard Server Edition WAF, allowing them to gain root or SYSTEM privileges. Concurrently, seven ConnectWise application identities were compromised, leading to unauthorized access to customer Microsoft 365 tenants.… 
Poland Wiper Attacks Utilize Obfuscated Files and Deobfuscation Techniques In the 2025 Poland Wiper Attacks, adversaries employed obfuscated files to conceal malware artifacts, specifically using Base64-encoded ZIP archives to evade detection. The attacks affected various systems, leveraging techniques like encrypted payloads and user execution. Tools such as certutil were utilized for…