Earlier Friday, Google Threat Intelligence chief John Hultquist said many publicly circulating proof-of-concept exploits appeared to be AI-generated and failed to achieve remote code execution, though Google had validated some exploits working against default mod_php deployments. Separate honeypot telemetry over a 26-hour window logged 30 out-of-memory errors and 11 worker crashes from probing waves without successful code execution. Meanwhile, the FBI and NSA issued renewed advisories alongside CISA, CERT-EU and UK and Australian cyber agencies urging organizations to patch immediately to PHP versions 8.2.35, 8.3.36, 8.4.27 or 8.5.12, rotate exposed credentials, or take unpatched systems offline.

CrowdStrike CEO George Kurtz told CNBC on Friday to expect a wave of breaches in the coming months from outdated routers, firewalls and servers running older PHP versions that will never receive patches. Palo Alto Networks’ Unit 42 estimated that more than a third of the 22 million internet-exposed systems vulnerable to the two CVSS 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, run software that cannot be patched and will take months to upgrade. The vulnerabilities, discovered using OpenAI and Google AI models, have drawn millions of exploit attempts on Cloudflare’s network since their Oct 21 disclosure.