PHP2Shell vulnerability exposed, QiAnXin Tianji provides one-click quick-check solution

On October 21, two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively known as "PHP2Shell," were disclosed in PHP, a server-side programming language widely used around the world. Verified by Qi An Xin technology experts, the vulnerabilities allow unauthenticated remote arbitrary command execution and constitute a severe security risk at the level of internet infrastructure, with potential impact on more than a million assets in China. Because the exploitation threshold is extremely low, it could easily evolve into large-scale worm-like propagation attacks, directly threatening the security of China's critical information infrastructure; key protection targets such as government and enterprise official websites and public service platforms all fall within the high-risk exposure range.

Qi An Xin security experts believe that "PHP2Shell" is not an isolated vulnerability incident; it exposes the fact that, in the current context of deep AI-driven attack-defense competition, the vulnerability threat facing the world is becoming increasingly severe, and government and enterprise institutions urgently need to build real-time, comprehensive, and routine penetration testing systems. The Qi An Xin Tianji AI intelligent penetration testing system offers a "one-click quick check" solution—users only need to log in to ai.qianxin.com and use Tianji in the application center to launch penetration testing against authorized websites and check vulnerability risks with one click.

Viewing the vulnerability landscape through PHP2Shell: three major trends drive the normalization of vulnerability discovery

The reason PHP2Shell triggered an emergency response worldwide is precisely that it is not "yet another vulnerability in some application," but a problem in the most common basic runtime environment of the internet itself. If a website is compared to a building, PHP is the foundation. Whether what is built on top is WordPress, Drupal, or a self-developed system, if the foundation has a problem, the whole building is in danger. Attackers do not need an account or password; by sending a carefully crafted request, they can execute arbitrary commands on the server, steal data, implant backdoors, and even laterally control the entire internal network.

But what is more worthy of vigilance than this vulnerability itself are the three trend-level changes it reveals.

First, AI is pushing vulnerabilities into an era of "mass production." The Qi An Xin "2026 Mid-Year Cybersecurity Vulnerability Threat Landscape Research Report" shows that in the first half of 2026, the total number of newly added vulnerabilities reached 35,467, a year-on-year increase of 51.9%, with high-risk and critical-risk vulnerabilities accounting for 52.1%. More critical is speed: 30.2% of high-risk vulnerabilities were exploited on the day of publication, and 83.7% were attacked within 21 days. The report clearly points out that with the popularization of generative artificial intelligence in software development and security attack-defense, the vulnerability lifecycle has been extremely compressed, and attack-defense has entered an "hour-level" era. Mythos further verifies this trend: in an industrialized era where AI enables batch vulnerability discovery and automatically launches attacks, enterprise vulnerability protection must rapidly "upgrade its dimension."

Second, the coverage of vulnerabilities has become "infrastructure-level." W3Techs statistics show that about three-quarters of websites worldwide use PHP as their server-side programming language. VirusTotal scan data shows that there are more than 5.1 million detectable PHP hosts on the internet, and this does not even count the "invisible" PHP in internal networks, test environments, and branch offices. The Qi An Xin 2026 mid-year vulnerability report also shows that vulnerabilities in mainstream vendors such as Linux, Microsoft, and Amazon rank high, and open-source software has become a heavily affected area of attack due to its widespread use. Government agencies, the financial sector, energy, and critical infrastructure have become key attack targets; targeted attacks and ransomware attacks carried out by APT organizations exploiting vulnerabilities occur frequently, highlighting the potential impact of the vulnerability threat on national security and economic stability.

Third, behind a single-point vulnerability lies a long-standing "invisible risk." This time it is PHP; next time it could be some middleware, some framework, or some open-source component. Any such incident will bring the same question to the fore: do institutions actually know what assets they have, which assets are exposed to the public internet, which assets are running risky versions, and which business paths attackers can traverse? Enterprises need to face these questions directly.

Qi An Xin security experts believe that this PHP vulnerability incident has sounded an alarm for institutions worldwide: comprehensive vulnerability discovery should not be an emergency action after an incident occurs, but should become a foundational and routine part of security operations and even digital business construction. Institutions need to embed automated penetration testing into daily operations—continuously mapping the asset exposure surface, continuously verifying real risks along business paths, and continuously accumulating reviewable evidence—rather than scrambling for temporary fixes only when the next "epic vulnerability" appears. Only by making "vulnerability discovery" routine can they keep the initiative in their own hands in an era where AI accelerates attack and defense.

The Qi An Xin Tianji AI intelligent penetration testing system was born precisely for such scenarios. Users only need to enter a website address, and the system can use AI to autonomously complete the entire process from information gathering, website map construction, and function tree analysis to vulnerability verification, without writing scripts or configuring complex rules, truly achieving "initiate like a scanner, test like an expert."

The core capabilities of Tianji are reflected at three levels:

l AI-native autonomous decision-making. Tianji is centered on large-model-driven agents: the main planning agent understands goals and constraints, splits tasks, and evaluates feedback, while the browser agent and login testing agent execute in division of labor. The system combines page content, interactive elements, and business descriptions to understand functional purposes, autonomously completes operations such as navigation, clicking, form filling, and pop-up handling, and adjusts subsequent routes based on new pages and execution feedback.

l Cloud-device collaborative distributed execution. The system adopts a "server-side brain + distributed operation endpoints" architecture, with the server side performing unified orchestration and the operation endpoints providing execution capabilities close to the target network. Target traffic is emitted from the network where the operation endpoint performing execution resides, and operation endpoints can scale out horizontally on demand, making the system suitable for covering headquarters, branches, and different business regions.

l Process visibility and closed-loop evidence. Operators can view task status, agent processes, tool execution, and real-time logs. The system summarizes vulnerability names, risk levels, problem descriptions, and testing processes by task, and supports exporting vulnerability data and task reports. Requests and responses triggered by browser interactions enter the task-associated traffic analysis and detection pipeline. AI combines page state and business context to analyze risk clues, preserving request-response and operation records for vulnerability review.

In actual production deployment, Tianji has covered approximately 7,000 systems, spanning industries such as enterprises, securities, banking, healthcare, education, and telecom operators. AI execution plus manual review improves efficiency by approximately 61% compared with purely manual work. AI autonomous execution averages about 3 hours per system, while manual review averages 10 to 30 minutes per system, enabling continuous 7×24h unattended execution.

Tianji is very simple to use: customers only need to log in to ai.qianxin.com, register an enterprise account, submit a site ownership authorization letter, complete enterprise certification and application activation, and then use Tianji in the application center to launch penetration testing against authorized websites, enabling one-click rapid checks for various vulnerability risks.

Conclusion: Only by making "vulnerability discovery" routine can we counter speed with speed

Behind the major PHP vulnerability is, in essence, a vulnerability automatically discovered by AI, whose speed and breadth of impact are unprecedented. But more important than this single vulnerability is that it confirms the judgment of Qi An Xin's 2026 mid-year vulnerability report: offense and defense have entered the "hour-level" era, and traditional passive protection models are no longer sustainable.

Faced with the offense-defense imbalance brought by AI, defenders need to use AI means to turn comprehensive vulnerability discovery from an "emergency action" into "routine work," countering speed with speed and staying ahead of attackers to prevent trouble before it occurs. With AI-native penetration testing capabilities, Qi An Xin Tianji helps government and enterprise organizations quickly complete asset investigation and risk verification during the vulnerability window, and further helps security teams embed automated penetration testing into daily operations, freeing up energy from repetitive page exploration and evidence organization to focus on key risk confirmation and remediation communication.