Two critical security vulnerabilities in PHP — the language behind roughly 70% of the world's websites — have triggered urgent warnings to operators and security teams.

The flaws, collectively nicknamed PHP2Shell, allow an unauthenticated attacker to execute malicious code remotely on a vulnerable server without ever logging in.

Both carry a CVSS v4.0 severity score of 9.2 out of 10, well into critical territory, and PHP developers shipped security updates on October 21 urging administrators to patch immediately, per the official PHP security advisory.

The timing is the twist a working programmer would talk about: exploitation attempts began before the fixes were even public.

JD Supra reports on evidence that attack attempts preceded the PHP2Shell patch, and KDBC's Fact Check Team relays BleepingComputer's reporting that researchers documented attempts targeting the flaws prior to public disclosure.

Some later tests went further, demonstrating successful remote code execution — meaning attackers had a working window while defenders were still waiting for an advisory.

The exploitation record is concrete, not speculative. On October 26, CISA added both vulnerabilities to its Known Exploited Vulnerabilities Catalog, which flags flaws with evidence of real-world exploitation and sets remediation deadlines for federal civilian agencies.

On October 27, KDBC reports that cybersecurity coverage described successful exploitation against honeypot systems — deliberately exposed machines researchers use to study attacks.

The distinction matters: proven exploitation of the flaw does not prove every vulnerable site was compromised or that customer data was stolen.

Because PHP powers online services, content management systems and platforms that handle sensitive customer information, an unauthenticated remote-code-execution bug in it is close to a worst case.

KDBC lays out the response checklist: identify affected installations and apply the updates immediately, prioritize internet-facing systems, work with web-hosting providers, check PHP copies bundled with third-party applications, and review system logs for suspicious activity.

Systems that cannot be patched promptly should follow official guidance to reduce exposure.

AI is on both ends of this story. KDBC notes researchers used artificial intelligence to identify and demonstrate the PHP2Shell flaws — the same techniques that can help malicious actors study unpatched systems.

Meanwhile, TechGig reports Google is opening Android Studio and the Android CLI to third-party coding agents like Claude Code and Codex, with new CLI commands for Compose previews and remote device access, plus an Android Bench 2.0 to evaluate agent performance on complex development tasks.

The bottom line for the niche: fixes are available, exploitation is documented, and whether any particular company was hit depends on the logs of each system.