Critical PHP Vulnerability Exploited Before Disclosure

• Cloudflare CEO Matthew Prince stated that the PHP2SHELL vulnerability was likely exploited by nation-state actors and criminals.
• The vulnerability had been present for years before its disclosure, according to Prince.
• OpenAI's GPT 5.6-Sol discovered the critical PHP vulnerabilities in October 2026.
• A small team of PHP maintainers had been aware of the issue for two years prior to its disclosure.
• Security experts had long warned about the risks of technical debt in open-source projects.