Two critical vulnerabilities in PHP, the server-side language behind roughly 70% of the world’s websites, were publicly disclosed on October 21 under the name PHP2Shell, after emergency patches shipped the same day. The flaws allow an unauthenticated attacker to execute code on an affected server or read sensitive data from its memory, and they sit in PHP itself rather than in any application running on top of it.
Wiz Research, the security team at Google-owned Wiz, said it found the bugs with the help of frontier AI models, and OpenAI said the security firm Calif independently identified one of them using GPT-5.6 Sol under its Patch the Planet programme. The US National Security Agency and the UK’s National Cyber Security Centre both urged operators to patch immediately — or take a system offline until it can be updated.
PHP2Shell: Two CVEs, Both Rated 9.2
The disclosed bugs are grouped under two identifiers, CVE-2026-109618 and CVE-2026-109619, each carrying a CVSS v4 severity score of 9.2. Both are memory-safety issues rooted in how PHP handles fatal errors, particularly out-of-memory errors, while processing a request: a request that dies unexpectedly can leave corrupted internal state behind, and a later request handled by the same worker can reuse that stale state to leak or corrupt memory.
CVE-2026-109618 combines an upload-progress unserializer use-after-free with a remote process-memory disclosure. Wiz demonstrated pre-authentication remote code execution against WordPress, Drupal and Joomla, plus unauthenticated disclosure of PHP worker memory — memory that can hold passwords, authentication tokens, API keys and certificates from other requests. CVE-2026-109619 pairs a fatal-error backtrace use-after-free with an OPcache type confusion, and Wiz demonstrated pre-authentication code execution on Drupal and WordPress through it.
Wiz stresses that exploitation does not depend on a flaw in application code: even a simple “Hello World” page on an affected PHP version can be vulnerable. Every PHP version released in the last decade, back to 5.4, is affected by at least one of the two bugs.
The Fixes And Who Is Covered
PHP shipped patched releases on October 21: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. That leaves a long exposed tail — PHP 8.1 and older are no longer supported, so sites on those branches have upgrade work to do, not just a patch to apply. Wiz reported the flaws to the PHP security team on August 24, PHP acknowledged them on September 21, and disclosure was coordinated for the day the fixes landed.
Before going public, Wiz worked with the PHP team, Calif and OpenAI on the patch and its verification, and with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel on customer guidance and mitigations for operators who cannot update at once. Wiz says defenders should watch for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained PHP worker churn — while noting that applying the security update is the only complete remediation.
How AI Found What A Decade Of Review Missed
Wiz says it used its Wiz Atlas security agent, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol throughout the research, with Gemini 4 Argon making what it calls an invaluable contribution to finding the flaw, building the exploit, detecting attacks and validating the patch. OpenAI says Calif found one critical flaw using GPT-5.6 Sol, as part of the Patch the Planet open-source security initiative it launched in June with Trail of Bits.
The same pattern — AI systems auditing widely used code and surfacing real weaknesses — is behind several recent disclosures on this site, from Claude’s attack-surface work on OpenSSH to the supply-chain compromise in the LiteLLM PyPI release and the OpenCode console breach. Wiz’s warning cuts both ways: the models that helped defenders build this exploit in about a week — work it says would previously have taken a world-class team months — can also help attackers adapt exploits to different PHP versions, configurations and memory layouts.
Why It Matters
PHP2Shell matters because of where PHP sits: underneath WordPress, Drupal, Joomla, Wikipedia’s MediaWiki and millions of independently managed servers, including a large share of the publishing and commerce web. A flaw in the engine reaches every one of those sites at once, however careful their own code is, and the patch-or-go-offline advice from two national security agencies shows how seriously governments rate the exposure.
It is also a marker for how vulnerability research is changing. Bugs that survived more than a decade of human review became working exploits once frontier models could chain flaws and iterate against different memory layouts — which shortens the safe window for every unpatched legacy system on the internet, and raises the value of the coordinated, patch-first disclosure that Wiz, OpenAI, Calif and the PHP team ran here.
Background
PHP was created in 1994 and grew into the default language of the shared-hosting web, powering the content management systems most organisations still rely on. Wiz compares PHP2Shell’s potential reach to Heartbleed in 2014 and Log4Shell in 2021 — earlier moments when a flaw in shared infrastructure forced a global patching scramble — and argues this one is distinctively a product of the AI era, because AI is what made the long-hidden flaws practical to exploit.
Source: Wiz Research, TechCrunch
0 Comments