Your business software, looked after every week

Why it matters now

How fast it moves: php2shell, October 2026

On 21/10/2026 the PHP project fixed two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, known as “php2shell”. Both allow remote code execution and are rated 9.2 (CVSS 4.0). According to PHP, both can be exploited by an attacker who doesn’t need to sign in. The US Cybersecurity and Infrastructure Security Agency (CISA) says they affect every way PHP serves web requests, so a website or system on an unpatched version could be taken over by a stranger on the internet.

1. 17/10/2026Amazon Threat Intelligence sees a php2shell exploitation attempt against its honeypot network, four days before the flaws are public (reported by Tenable).
2. 21/10/2026PHP releases fixed versions (8.5.12, 8.4.27, 8.3.36 and 8.2.35). CISA publishes an alert the same day.
3. 23/10/2026Palo Alto Networks Unit 42 publishes a threat brief: its Cortex Xpanse telemetry finds over 22.6 million exposed instances potentially vulnerable.
4. 26/10/2026CISA adds both CVEs to its Known Exploited Vulnerabilities catalogue.

How many systems were exposed depends on who counted. Unit 42’s 22.6 million is the largest figure; other researchers quoted by Tenable estimate 1.3 million and 1.9 million internet-facing hosts. Any of them is a lot of businesses with a few days to act, and older PHP versions that no longer get updates have no official fix at all.

The systems I build run on .NET, not PHP, so this one didn’t touch them. I use it because it shows the timescale: an exploitation attempt was seen four days before the fix existed, and five days after the fix, CISA had listed both flaws as known to be exploited. .NET has its own security updates, and the same clock applies.

More code, written faster, read less

AI coding tools mean more software is being written, and faster. I use them too: they write code, and I review, test and take responsibility for every line that reaches you (how that works). Not all code gets that read. In Veracode’s 2025 tests of more than 100 AI models on 80 coding tasks, the models introduced a vulnerability from the OWASP Top 10 list in 45% of test cases, and larger models did not do significantly better than smaller ones. Google’s 2024 DORA research found that 39% of the people it surveyed had little or no trust in AI-generated code, and that rising AI adoption went with an estimated 7.2% reduction in delivery stability.

None of that is a reason to avoid AI-written code. It is a reason to make sure someone keeps reading your system after it ships, because the mistakes it makes are the quiet kind.

The question isn’t whether a flaw appears. It’s how quickly someone who knows your system notices, and fixes it.