PHP2Shell Vulnerability Exposes Major Gaps in Cyber Defense

• •PHP2Shell vulnerabilities disclosed on October 21, 2026, with critical flaws in PHP.
• •Less than 1% of affected Fortune 500 assets were patched by the end of the day after disclosure.
• •AI-assisted research identified the vulnerabilities and developed exploits within a week.

Cogent Security reported that the PHP2Shell vulnerability, disclosed on October 21, 2026, revealed critical flaws in PHP that had persisted for over a decade. The vulnerabilities led to millions of exploitation attempts on the same day, with Cloudflare recording significant attack activity. By the end of the day, less than 1% of affected assets in Fortune 500 companies had been patched. The vulnerabilities were identified through AI-assisted research, which also developed working exploits within a week. The rapid pace of exploitation, often occurring before patches are available, highlights the disparity between attackers and enterprise defenses. Cogent Security emphasizes the need for a factory-like approach to cyber defense to keep up with attackers who have already adopted such methods. The vulnerabilities are critical due to their long-standing presence and the speed at which they were exploited.