AI News Feed
Market watch
Google Cloud Unveils Agent Compute Engine With a MicroVM per AI AgentYou.com Launches Managed Inference Router for 12 Open-Weight ModelsSaaSHub Data Shows Median Product Lifespan Falling to About 1.5 YearsQi An Xin Warns of PHP2Shell Risks, Offers One-Click Vulnerability CheckChina Sets First Industry Standard for Window-Cleaning RobotsQwen Go! Launches My Apps for No-Code, Shareable Long-Term Applications
Google Cloud Unveils Agent Compute Engine With a MicroVM per AI AgentYou.com Launches Managed Inference Router for 12 Open-Weight ModelsSaaSHub Data Shows Median Product Lifespan Falling to About 1.5 YearsQi An Xin Warns of PHP2Shell Risks, Offers One-Click Vulnerability CheckChina Sets First Industry Standard for Window-Cleaning RobotsQwen Go! Launches My Apps for No-Code, Shareable Long-Term Applications
Cybersecurity

Qi An Xin Warns of PHP2Shell Risks, Offers One-Click Vulnerability Check

Qi An Xin said two severe PHP flaws dubbed PHP2Shell can be exploited without authentication for remote command execution, potentially affecting more than one million assets in China. It is offering one-click checks through its Tianji AI penetration-testing system.

AI News Feed · 2026-10-23 14:36

The two flaws, CVE-2026-109618 and CVE-2026-109619, were verified by Qi An Xin technical experts. The company said the low exploitation threshold could lead to worm-like attacks and directly threaten critical information infrastructure. Government and enterprise websites and public service platforms are among the high-risk exposed targets.

Qi An Xin security experts said PHP2Shell is not an isolated incident. They pointed to the company's 2026 mid-year network security vulnerability threat report, which recorded 35,467 new vulnerabilities in the first half of 2026, up 51.9% year on year, with high and critical flaws accounting for 52.1%. The report said 30.2% of high-risk vulnerabilities were exploited on the day they were published and 83.7% were attacked within 21 days. It also said generative AI is compressing vulnerability lifecycles and pushing attack and defense into an hourly cycle.

The exposure is broad because PHP is used as a server-side language by about three-quarters of websites worldwide, according to W3Techs. VirusTotal scanning data cited by Qi An Xin showed more than 5.1 million detectable PHP hosts on the internet, excluding internal systems, test environments and branch systems that are not visible from outside.

Qi An Xin said the incident shows organizations need to know which assets are exposed to the public internet, which run vulnerable versions and which business paths attackers can use. It argued that automated penetration testing should be embedded in daily operations rather than used only after a major flaw emerges.

To address the risk, Qi An Xin is offering a one-click query through its Tianji AI intelligent penetration testing system. Users can log in to ai.qianxin.com, submit an authorization letter for site ownership, complete enterprise authentication and application activation, and then use Tianji in the application center to launch penetration tests against authorized websites, the company said.

The system uses large-model-driven agents for planning, browser interaction and login testing. It also uses a server-side brain plus distributed execution nodes, allowing traffic to originate near the target network and capacity to scale horizontally. Operators can view task status, agent processes, tool execution and real-time logs, and export vulnerability data and task reports.

Qi An Xin said Tianji has been deployed across about 7,000 systems in industries including enterprises, securities, banking, healthcare, education and telecom. AI execution plus human review improved efficiency by about 61% compared with manual work, according to the company. AI autonomous execution averaged about three hours per system, while human review took 10 to 30 minutes per system, and the system can run unattended 24 hours a day.