Starting October 21, 2026, Government of Canada websites, Statistics Canada among them, began going offline. No breach had been reported. Operators pulled the sites on purpose, following guidance from the Canadian Centre for Cyber Security, because two critical flaws in PHP had just gone public.
Here is the twist. Researchers found those flaws with help from AI models. That makes PHP2Shell a clear, real-world answer to a question many Canadian leaders are asking. How do hackers use AI, and should we worry?
The honest answer sits between hype and denial. AI is not a push-button hacking machine. It does shorten the road from a weakness to a working attack. This guide shows how, explains what it means for your PHP systems and gives you a defence plan to start today.
What PHP2Shell Showed Us About AI-Assisted Hacking
PHP2Shell is the nickname for two memory flaws, CVE-2026-109618 and CVE-2026-109619. Each scores 9.2 out of 10 on the CVSS 4.0 scale. Either one can let an unauthenticated attacker run code on a web server. The PHP project shipped fixes on October 21.
AI played a real but narrow role. According to MediaNama's summary of Calif's report, researcher Ryan Austin started with a hunch about old PHP weaknesses and used an AI model as a helper. Wiz found the same flaws independently. Bugs like these sat in the code for years because they looked too hard to exploit.
Two lessons follow. AI cut the cost of turning a hunch into a working exploit. But people still steered the work. The PHP Foundation said tools now find bugs faster for defenders and attackers alike, and that deciding on the right fix still takes experienced engineers.
Attackers moved fast too. Amazon's threat intelligence team logged an exploitation attempt on October 17, four days before the public fix. Cloudflare's CEO said attempts jumped from thousands to millions after the announcement. CISA then added both flaws to its Known Exploited Vulnerabilities catalogue.
How Hackers Use AI Across an Attack
Think of AI as a speed boost at each stage, not a new kind of criminal.
- Exploit research. Attackers can feed a disclosed CVE, a patch diff or an error log to a coding assistant. It explains the code and helps adapt proof-of-concept scripts. It can't promise a working exploit. Versions, permissions and server settings still decide what lands.
- Custom scripts. Python, PowerShell, JavaScript and Bash are all fair game. Criminals can tweak existing tools or automate dull steps. Custom code still isn't invisible. Behavioral detection catches what code does, even without a known signature.
- Phishing and impersonation. A model can write a clean, convincing email aimed at a finance lead or a clinic administrator. Voice and video cloning add pressure to payment fraud. Typos no longer give scams away. Verify money requests on a number you already trust.
- Malware and ransomware. Treat claims of fully autonomous malware with care. Generated code often fails in real environments. The bigger gain for criminals is time saved on repetitive work, which strengthens crews that already know what they're doing.
- Reconnaissance. Attackers study your public systems, technologies and exposed documents before they strike. AI summarizes that material and ranks targets fast. A forgotten PHP portal on a spare subdomain is just what that process finds.
The Numbers Behind the Speed
The data supports the speed argument, with caveats.
Bloomberg reported that the US National Vulnerability Database logged 45,207 flaws between January and July 27, 2026, close to the total for all of 2025. Recorded Future's Alexander Leslie said the average time to exploit a flaw fell from 72 hours to 24 hours.
IBM's 2026 X-Force Threat Intelligence Index found a 44% rise in attacks that began at public-facing applications. IBM tied the rise largely to missing authentication controls and AI-enabled discovery. Exploited vulnerabilities were the top way in, at 40% of incidents.
There is a counterpoint. Trend Micro's Dustin Childs said that as of July, actively exploited flaws had not risen with discoveries, and many finds came from vendors using AI on their own code. The pressure is real, and the window to patch is shrinking.
The PHP Vulnerability Every Website Owner Should Understand
PHP runs on roughly 69% of websites whose server-side language is known, including WordPress, Drupal, Joomla and Magento sites. These flaws live in the PHP runtime itself. Updating a plugin or theme won't fix them. You have to update PHP.
- Fixed versions. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per CERT-EU. PHP 8.1 and older no longer get upstream updates. Source backports exist for 7.4, 8.0 and 8.1, and some Linux vendors ship their own fixes.
- Where PHP hides. Look past your main site. The Cyber Centre's alert AL26-026 says to prioritize internet-facing systems, and CISA tells organizations to find PHP inside third-party software too. Control panels, vendor appliances, containers and old staging servers all count.
- Check the real version. Version numbers can mislead. OpenAI's checker returns "unknown" when a server hides its version, and some Linux distributions patch without changing the number. Ask your host in writing or check the package changelog.
- Patching is not the finish line. The earliest known attempt dates to October 17. Review web server and process logs from that date for PHP workers launching shells, new files or odd outbound traffic. The NCSC also urges teams to hunt for backdoors.
- Stopgaps are partial. CERT-EU says temporary settings, such as turning off session upload progress, reduce exposure but don't make a server safe. A web application firewall only buys time. CERT-EU also flagged a third flaw, CVE-2026-115560, on October 23. It affects unusual configurations only, and the same setting covers it until the next release.
AI tools can also read custom PHP code fast, helping attackers hunt for SQL injection, cross-site scripting and unsafe file uploads. Test your own code, not just your runtime. Our php2shell patch guide walks through the full response.
Why Scanners Alone Miss What AI-Assisted Attackers Find
A scanner can tell you a PHP version is old. It can't tell you what an attacker could do next. Business logic flaws, broken access control and chained weaknesses slip past automated tools. A small access problem can turn serious once it meets an information leak or a weak login.
Manual testing closes that gap. Our testers think like a motivated attacker, then prove what is exploitable and what it would cost you. That separates real risk from scanner noise. Our guide to penetration testing vs vulnerability scanning explains when to use each.
A Practical Defense Plan for Canadian Organizations
You can't stop attackers from using AI. You can shrink what they find. Start here:
- Inventory PHP everywhere. Servers, containers, appliances, hosting accounts and vendor software.
- Patch internet-facing systems first. Aim for hours, not weeks. If you can't patch, isolate the system or take it offline.
- Verify the fix. Confirm the running version and that the issue no longer reproduces.
- Harden identity. Use phishing-resistant multifactor authentication and limit privileged access.
- Watch behaviour. Keep useful logs, run endpoint detection and investigate odd activity instead of trusting file signatures.
- Rehearse incident response. Know who to call before the bad day arrives.
- Retest after fixes. Confirm every gap is actually closed.
Compliance raises the stakes. A breach that exposes personal information can trigger PIPEDA reporting duties when it creates a real risk of significant harm. Operators of designated critical cyber systems face added duties under Bill C-8, which we cover in our Bill C-8 guide.
How PlutoSec Helps You Stay Ahead
PlutoSec is a Canadian cybersecurity company based in Etobicoke, Ontario, serving clients in every province. Our team holds OSCP, CISSP, GPEN and CEH credentials, and we're ISO 27001 certified. We take a manual-first approach, so every finding is validated by a person, not passed along from a scanner.
- Web application and API penetration testing find the logic and code flaws attackers hunt, including PHP application bugs.
- External and internal penetration testing shows what attackers see from outside and how far they get inside.
- Offensive security and red teaming tests your people, process and detection against a realistic adversary.
- Cloud and infrastructure security hardens servers, configurations and identities.
- Managed detection and response watches for suspicious behaviour around the clock.
- Cyber incident response contains and investigates if a PHP server turns out to be compromised.
Every engagement ends with a technical report, a plain-language summary for leadership and a retest to confirm fixes hold. For the defender's side, read how AI is shaping cybersecurity in 2026.
Final Thoughts
AI is not replacing hackers. It is speeding up the ones who already know what they're doing. PHP2Shell showed how fast a hidden weakness can go from one researcher's hunch to a global scramble.
You don't need to fear that. You need a faster routine: know your assets, patch quickly, test like an attacker and rehearse your response.
Not sure where PHP runs in your business? Book a free consultation with PlutoSec. We'll help you find it, fix it and prove it's safe.
Written by
Jonathan Zachary
