As the world scrambles to patch critical PHP flaws, healthcare must be ready for a new cybersecurity era

Key takeaways

Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively called PHP2Shell and discovered by researchers using OpenAI models, enable remote code execution across roughly 70 percent of websites, and CISA has added both to its Known Exploited Vulnerabilities catalog. FinThrive CISO Greg Surla says his team found more than 2,300 machines running PHP, including many internal workstations, while Censys data shows at least 32.5 million PHP services remain unpatched. Surla and the AHA warn that patching alone won’t help if attackers already have access, and that AI-driven vulnerability discovery means CISA’s KEV list now grows almost daily, outpacing the traditional cadence of patching.

Last week, the discovery of two critical vulnerabilities in the widely used open-source programming language PHP sent organizations around the world on a mad dash to patch. Researchers discovered the security flaws using OpenAI models, The New York Times reports.

This global incident shows how AI is reshaping the cybersecurity landscape. What do healthcare industry leaders need to know about the PHP2Shell vulnerabilities and AI-driven vulnerability discovery?

The PHP vulnerabilities affect 70 percent of websites

If exploited, the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) enable remote code execution in PHP, according to the Cybersecurity and Infrastructure Security Agency (CISA). Approximately 70 percent of websites and web applications use PHP, putting a large share of the internet at risk, according to The New York Times.

As a precautionary measure, many organizations around the world, including governments, took down their websites while they applied the available patches.

Greg Surla, senior vice president and CISO of FinThrive, a healthcare revenue cycle management company, told DHI his team immediately began patching.

“Our team immediately jumped on and started inventorying. I think they found something like 2,300-plus machines that were running PHP,” he shared. “Not every machine was a server or even an externally facing server, but there were quite a few and a lot of our own workstations.”

Surla also noted that FinThrive fielded a lot of inquiries from concerned customers wanting to confirm that the company had mitigated any PHP issues.

If left unpatched, these vulnerabilities could have a widespread impact on healthcare

While many organizations leapt into action and patched the PHP vulnerabilities, millions of servers remain vulnerable to exploitation. On Oct. 27, Cybernews reported that data from cybersecurity company Censys indicates at least 32.5 million PHP services are still running versions vulnerable to exploitation.

And hackers are already exploiting the vulnerabilities. CISA added the two security flaws to the Known Exploited Vulnerabilities (KEV) Catalog. Patching will not be enough to mitigate risk if hackers gain access to systems before the patch is applied, according to a cybersecurity advisory from the American Hospital Association (AHA).

If healthcare organizations leave these vulnerabilities unmitigated, the risks are substantial. Hackers could leverage PHP2Shell to “steal sensitive data, disrupt services or move deeper into a network,” according to the National Security Agency (NSA).

“The whole healthcare ecosystem, whether it’s RCM or patient care, all of these systems are interconnected. If one piece of the puzzle fails, you have the potential of bringing down the rest of the environment,” Surla said.

AI-discovered vulnerabilities are changing cybersecurity

In the case of PHP2Shell, security researchers used AI to discover the vulnerabilities. This case is a stark example of how AI makes it easier to find vulnerabilities, and researchers won’t necessarily find them first. Attackers can use AI to find security flaws faster than defending organizations can patch them. That increases exposure and creates more work for cybersecurity teams.

“CISA’s KEV list keeps growing. What used to be a couple of times a month, now it seems it’s almost every day we’re seeing something new put on the KEV list,” Surla pointed out.

The historical pace of patching will no longer be fast enough, which makes cyber resilience even more critical in industries like healthcare.

Carrie Pallardy, a Chicago-based freelance writer and editor, began her career covering healthcare more than a decade ago. Her work has taken into many different industries, but covering healthcare delivery remains a constant focus. She can be reached at [email protected] or on LinkedIn.