Global – October 31, 2026 -- A PHP vulnerability that stalled in triage after a 2024 audit became unauthenticated remote code execution this year once researchers applied frontier AI models, and both PHP2Shell CVEs now carry a CVSS v4.0 score of 9.2.