The Internet Is Buzzing Right Now

In the last couple of days, a slew of security vulnerabilities has surfaced, sending ripples through the online community. While PHP2Shell is the headline-grabber, it’s far from the only significant issue that’s come to light recently.

No need to panic just yet! Sure, it’s unsettling to see so many online threats emerging simultaneously, but let’s take a moment to gather our thoughts before we start unplugging everything and boarding up our windows. The big question is whether these vulnerabilities are coincidental or if there’s something more nefarious at play. Spoiler alert: it’s the latter.

To shed some light on the situation, here are a couple of insightful quotes. First up, Cloudflare’s CEO Matthew Prince noted, “In the 10 hours before [the PHP vulnerability] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”

Here’s a second perspective from Wiz Research, one of the teams that uncovered the PHP vulnerability: “Pre-AI, this manual work would be difficult to implement and even harder to scale. This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.”

In simpler terms, AI has improved at both spotting and fixing vulnerabilities, which is great! However, it’s also become more adept at exploiting them, making this enhanced detection a double-edged sword. This explains why so many issues are cropping up at once and why those reporting them are understandably concerned. It’s a bit like the Wild West out there: everyone’s armed, and we can only hope the bad actors aren’t great shots.

Now, let’s dive into the most urgent vulnerabilities that have been identified over the past week. Just a heads-up: more may have emerged by the time you read this.

First on the list is PHP2Shell. For those unfamiliar, PHP originally stood for Personal Home Page, but now it’s known as Hypertext Preprocessor. It’s a programming language that powers a vast array of websites, mobile apps, and data applications.

A crucial detail that seems to have slipped under the radar is that PHP2Shell consists of two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both allow for the same exploit, known as Remote Code Execution (RCE).

In layman’s terms, RCE lets someone execute code on your machine from afar, without your consent. Approximately 70 percent of websites rely on PHP, which is why the NSA and the UK’s National Cyber Security Centre have advised websites to go offline until these vulnerabilities are patched.

But how does this impact gaming? There are numerous examples, but here are a few highlights: Square Enix has reported “confirmed instances of unauthorized access” by third parties, several Pokémon apps had to go offline for “emergency maintenance,” and two of Japan’s oldest mobile games will be permanently shut down due to the PHP vulnerability.

GitLab, a Git repository manager similar to GitHub, reported CVE-2026-110264 recently. This is another RCE vulnerability, but it comes with a concerning detail: it’s rated a perfect 10 on the Common Vulnerability Scoring System scale.

For context, the PHP2Shell vulnerabilities are rated 9.2 out of 10. It seems odd that PHP2Shell, which threatens 70 percent of all websites, is rated lower than GitLab’s vulnerability, right?

The explanation is straightforward: CVE-2026-110264 is easier to exploit, as the National Vulnerability Database indicates it has a low “complexity” threshold. It primarily affects GitLab versions prior to 2015, up to and including version 7.0. GitLab has “strongly” recommended that all self-managed installations upgrade immediately.

While PHP2Shell consists of two CVEs, Plex2Shell has four—and yes, the “Plex” in the name refers to the streaming service with over 42 million active subscribers.

Here’s the good news: this has been fixed. The bad news? It’s pretty severe, so if you’re a Plex user, make sure you’ve updated all your Plex-related software and apps.

Plex reported these vulnerabilities in early September, but the CVEs were only released on October 20: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. In short, these vulnerabilities combine to allow for remote code execution.

Plex has noted multiple attacks over the past month, with many attackers using the vulnerability to turn compromised Plex servers into cryptocurrency miners: “Compromised servers have been used to run cryptocurrency miners and proxy software, which routes other people’s traffic through the victim’s internet connection.”