3 November 2026
A sophisticated PHP exploit appeared on GitHub before the official security patches were released. Qurium traced its development to a pseudonymous Chinese researcher known as 9bie, whose code became a reference point for subsequent exploit implementations. As the disclosure process collapsed, suspicious traffic began reaching websites through commercial VPNs and residential proxy networks.
Qurium’s investigation exposes how a poorly coordinated disclosure, technically complex exploits, and the growing influence of artificial intelligence created confusion and unnecessary risks for millions of websites.
A security disclosure that went wrong
In October 2026, two critical vulnerabilities in PHP, one of the Internet’s most widely used programming languages, triggered a cybersecurity disclosure fiasco.
The PHP2Shell disclosure was initially planned as a coordinated release, allowing PHP developers to prepare security patches before technical details became public. Instead, a demonstration video produced by security researchers at Calif was “accidentally” published ahead of schedule, triggering a chain of events that undermined the coordinated disclosure process.
Before official patches became available, proof-of-concept exploit code had already appeared on GitHub. The premature exposure forced the PHP project to accelerate its security announcement and patch release, leaving infrastructure operators with limited information about the vulnerabilities and how to protect their systems.
The situation was further complicated by a flood of hastily published security advisories, AI-generated explanations, vulnerability scanners, and purported exploits. Many of these implementations were technically inaccurate or unrelated to the actual vulnerabilities.
What should have been a carefully managed effort to protect vulnerable systems instead became a competition for visibility, raising important questions about responsibility, transparency, and the incentives driving modern vulnerability research.
9bie: Ground zero of the public exploit
Qurium traced one of the earliest sophisticated PHP2Shell exploits to a pseudonymous Chinese researcher known as 9bie (⑨BIE). His GitHub repository appeared approximately 15 hours after the leaked video, with exploit code published before the official security announcement.
The speed and technical sophistication of the implementation raise questions about how such a complex exploit could have been developed so quickly. Qurium identified 9bie’s code as an important reference point for subsequent public implementations and several elements of our analysis strongly suggest that the researcher had access to confidential information.
Artificial intelligence is changing what researchers can discover
AI-assisted research helped investigators explore code paths, identify subtle relationships between seemingly unrelated components, and develop exploitation techniques that would otherwise require extensive manual analysis.
The PHP2Shell discoveries demonstrate how advanced AI systems can help expose vulnerabilities that have escaped years of conventional security reviews, dramatically reducing the time needed to move from a theoretical weakness to a demonstrable attack.
But these capabilities introduce new risks. The same technologies that accelerate vulnerability discovery can also accelerate exploit development, generate misleading technical material, and overwhelm defenders with large volumes of low-quality security research.
The growing competition between AI companies to demonstrate increasingly powerful cybersecurity capabilities adds another dimension to the problem: when the ability to discover and exploit vulnerabilities advances faster than the mechanisms designed to disclose and mitigate them, the entire Internet becomes more exposed.
However, Qurium’s analysis of over 30 public exploit repositories revealed that turning these vulnerabilities into reliable attacks is far more complicated than widely reported. Most published tools failed to reproduce the complete exploitation chain, while AI-generated explanations and questionable proofs of concept contributed to widespread confusion.
Attacks concealed behind residential proxies
Following the disclosure, Qurium analyzed 15,557 suspicious HTTP requests from 89 IP addresses across 52 autonomous systems, targeting 191 protected websites.
Using intelligence from Nokia Deepfield and IPinfo, Qurium found that 40 source IPs were associated with proxy infrastructure and 32 with VPN or Tor services, with possible overlap between categories.
Some traffic originated from residential proxy networks, which route requests through ordinary household Internet connections, obscuring the actual operators and complicating attack attribution.
Although Qurium identified traffic resembling sophisticated PHP2Shell exploitation techniques, it found no conclusive evidence of a complete, successful exploitation chain inside of our infrastructure.
A warning for the cybersecurity industry
Qurium’s investigation concludes that PHP2Shell represents more than a critical software vulnerability. It illustrates a fundamental challenge facing the cybersecurity industry as artificial intelligence transforms vulnerability research.
Advanced AI tools are making it possible to discover previously overlooked weaknesses at unprecedented speed. Yet the processes responsible for coordinating disclosure, providing actionable mitigation guidance, and distinguishing credible threats from publicity-driven claims have not evolved at the same pace.
The central lesson is that the ability to discover vulnerabilities faster must be matched by an equally strong commitment to responsible disclosure, technical accuracy, and the protection of vulnerable systems.
Without that commitment, AI-powered security research risks becoming another source of instability rather than a means of making the Internet safer.
During the preparation of this article we mailed Calif and Wiz to inquire about the @9bie proof of concept and the leaked video. At the time of publication we had not received any response.
Read Qurium’s full investigation: PHP2Shell: A Disclosure Fiasco
Qurium Media Foundation is an international non-profit organization that provides secure hosting, digital forensics, incident response, and infrastructure protection for journalists, human rights defenders, and public-interest media organizations worldwide. Its investigations focus on censorship, surveillance, digital attacks, and the infrastructures that enable them. Learn more at qurium.org.
Press Contacts
Digital Forensics
Tord Lundström <t at virtualroad.org>
Technical Director
Media Contact
ClaraZid <info at virtualroad.org>
Outreach and Media manager