Several serious security vulnerabilities have emerged online over the past 48 hours, with PHP2Shell attracting the most attention. It is not the only major flaw under scrutiny, however, and the wider impact reaches services used by gamers, developers and home media enthusiasts.
Although the cluster of reports may look like a coincidence, the more concerning explanation is that artificial intelligence is changing both vulnerability discovery and exploitation. That does not mean people should unplug every device, but it does make prompt software updates and sensible security practices more important for Australian households and businesses.
For more gaming and technology coverage, browse RETROCADE’s arcade blog, including practical advice for owners of arcade machines and other connected equipment.
Cloudflare CEO Matthew Prince reported on X that his network saw thousands of attempts to exploit the PHP flaw during the 10 hours before its public announcement. That increased to tens of thousands within 45 minutes, hundreds of thousands after two hours and millions by October 22, 2026.
Wiz Research, one of the teams that discovered the PHP issue, also highlighted the effect of AI. Its assessment is that automation reduces the work required to develop and adapt sophisticated exploits, making vulnerabilities that were previously too difficult or expensive to attack more viable targets.
In short, AI can help defenders locate and fix weaknesses faster, but it can also help attackers find and weaponise them. That arms race helps explain why several important disclosures have appeared together. The following are the most pressing issues identified during the period covered here, although further reports may have emerged by publication.
PHP2Shell: CVE-2026-109618 and CVE-2026-109619
PHP is a programming language used to power websites, mobile applications, data-driven services and more. The name originally referred to “Personal Home Page”; today, it is generally understood as “PHP: Hypertext Preprocessor”.
PHP2Shell is not one vulnerability but two: CVE-2026-109618 and CVE-2026-109619. Both can be used for remote code execution, or RCE, which allows an attacker to run code on a computer remotely without permission.
An estimated 70 per cent of websites depend on PHP. Because of that broad reach, the United States National Security Agency and the United Kingdom’s National Cyber Security Centre advised websites to go offline until the flaws were patched.
The gaming sector has also been affected. Square Enix has reported confirmed instances of unauthorised third-party access. Several Pokémon apps entered emergency maintenance, while two of Japan’s oldest mobile games are scheduled to shut down permanently following the discovery of the PHP vulnerability.
GitLab: CVE-2026-110264
GitLab, a repository-management platform comparable to GitHub, disclosed CVE-2026-110264 last night. It is another remote-code-execution vulnerability and received a perfect 10 out of 10 rating under the Common Vulnerability Scoring System.
That score is higher than the 9.2 rating assigned to both PHP2Shell flaws. The difference appears to come down to exploit difficulty: the National Vulnerability Database describes the GitLab issue as having low complexity, making it easier to carry out.
The affected releases are GitLab versions up to and including 7.0, which date from before 2015. GitLab strongly recommends that operators of self-managed installations upgrade immediately to one of the supported versions.
For anyone maintaining a home arcade setup, the broader lesson is straightforward: keep operating systems, network devices and connected software updated. RETROCADE’s arcade machine buying guide is a useful starting point for understanding the hardware and software that may form part of a modern cabinet.
Plex2Shell: multiple CVEs
The Plex vulnerability group contains four CVEs, rather than the two associated with PHP2Shell. The name refers to Plex, the streaming platform, which has more than 42 million active subscribers.
The good news is that Plex has released fixes. The urgent part is that users need to confirm their Plex software and apps have been updated, because the underlying issue is severe.
Plex reported the vulnerabilities at the beginning of September, but the CVE identifiers were not assigned until October 20. They are CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Together, the flaws can enable remote code execution.
Plex said it had observed multiple attacks during the preceding month. In the most common cases, compromised servers were used to mine cryptocurrency or run proxy software, allowing other people’s traffic to pass through the victim’s internet connection.
Owners of connected entertainment hardware should treat this as a reminder to check updates rather than panic. That includes media servers, streaming devices and any networked equipment used alongside an arcade cabinet. RETROCADE also offers arcade parts for physical maintenance, but software security remains just as important for connected builds.
Leave a Reply