Ryan Austin dropped out of high school at 13 due to family problems. Years later, it was his curiosity about computers that made him one of the researchers who helped discover a serious vulnerability at the heart of much of the internet.
The 37-year-old American works remotely for the cybersecurity company Calif. In August 2026, he discovered a problem in the core of the PHP programming language, used by about 70% of internet sites, according to Wiz. The vulnerability was named PHP2Shell and turned out to be related to two separate flaws – CVE-2026-109618 and CVE-2026-109619.
Two critical vulnerabilities
The two vulnerabilities are rated 9.2 out of 10 on the CVSS 4.0 scale. Under certain conditions, they could allow an attacker without a user account to execute arbitrary code on an affected server. Some of the problematic code has existed in PHP for years, with its origins traced back to 2012.
According to media reports, the vulnerabilities were discovered as part of OpenAI's Patch the Planet initiative. Related issues were also discovered independently by Wiz researchers. This required coordination between companies, PHP developers and internet service providers before the information became public.
“When I finally realized how big the vulnerability was and what it affected, there was that moment of complete shock,“ Austin told The Times. He said the hardest part was getting the affected organizations notified without the details falling into the hands of malicious hackers.
Artificial intelligence pinpoints the problem
Austin used an artificial intelligence tool to review the PHP code. However, he did not automatically accept the result, but checked for himself whether the discovery was real and whether it could have practical consequences.
“The case shows that artificial intelligence can find such loopholes, but it also took a person like me to understand what it was about“, says the researcher.
It was precisely the human judgment that was important, since initially Austin was not sure whether the tool had made a mistake. After additional checks, he reported the problem to the PHP developers and worked on fixing it.
Hotfixes and attack attempts
On October 21, 2026, hotfixes were published for the supported PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. There is no update from the PHP team for older versions that are no longer supported.
According to Amazon, an attempt to exploit the vulnerability was detected before the public announcement. Since the problem was disclosed, multiple requests have been registered targeting potentially vulnerable servers. This does not automatically mean that all attempts have led to a successful breach, but it shows how quickly such information can be used.
Austin began working with computers as a teenager. He says that the lack of a diploma forced him to learn by reading other people's code and doing practical experiments. Today, that same curiosity helps him discover a problem that could affect websites, online services and organizations around the world.
Sources: kaldata.com, itpro.com, bleepingcomputer.com