PHP2Shell: AI uncovers critical RCE in PHP
A · Strong evidence Wiz Research documents two critical PHP engine CVEs with bug mechanics, demonstrated exploits and a dated disclosure timeline, though the claims about what AI changed are the vendor's own framing without effort or cost data.
Summary based on the full text·Original: about 12 minutes to read
In short
A 21 October 2026 post by Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz of Wiz Research disclosing "PHP2Shell": memory-safety flaws in the PHP engine's handling of fatal (mainly out-of-memory) errors, which leave stale state that a later request on the same worker can reuse. Wiz chained them into unauthenticated remote code execution on stock WordPress, Drupal and Joomla containers and into remote memory disclosure. Wiz credits frontier models (its own Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol) with making the exploit chain practical.
Key numbers
- CVSS 9.2top severity of the two CVEs grouping the four reported PHP memory-safety bugs
- 5.4oldest PHP version affected by at least one of the bugs
- August 19, 2026date Wiz found the first bug; reported 24 August, patched and disclosed 21 October
- 70%share of websites Wiz says run on PHP, its basis for the headline impact claim
As reported by the source.
English·Web page·opens wiz.io
What it reports
- Four exploitable bugs under two CVEs (CVE-2026-109618, CVE-2026-109619): an upload-progress unserializer use-after-free, a process-memory disclosure via the PHPSESSID cookie, a fatal-error backtrace use-after-free and an OPcache type confusion.
- The memory disclosure works even if the application never calls
session_start(), and can leak passwords, tokens and API keys from other requests. - Every PHP version back to 5.4 is affected by at least one bug; Wiz says other variants exist and the PHP patch fixes the root cause.
- Timeline: found 19 August; RCE confirmed on Drupal 20 August and WordPress 21 August; reported 24 August; PHP acknowledged 21 September; patch and disclosure 21 October.
- Claim: "a single researcher completed in a week what previously would have taken a world-class team months of work."
- Detection hints before patching: unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, malformed PHPSESSID cookies, unexplained worker churn.
- Coordination involved the PHP team, Calif, OpenAI and major cloud and CDN providers, which prepared mitigations.
How they got it
Vulnerability research with AI-assisted discovery and exploit adaptation, demonstrated against the latest official container images of three CMSs. Bug mechanics are described at code level; the exploit script itself is not published.
Limits
- The AI contribution is asserted, not measured: no time logs, prompts, model costs or comparison with a non-AI baseline.
- The "70% of the Internet" figure is the share of sites using PHP, not the share proven exploitable; real-world exploitability depends on configuration (a separate post this week argues the PoC is fragile).
- Wiz sells the detection and response products advertised in the post, and a Google DeepMind quote promotes Gemini.
Why it matters for companies
Any company running PHP, including WordPress or Drupal sites managed by agencies, should patch to the 21 October releases and check hosting providers have done so. The broader point holds even with the vendor gloss removed: old, complex bugs that were impractical to exploit are being turned into working chains faster, so "too hard to exploit" is a weaker reason to defer patching. Security teams should shorten patch windows for runtime and platform components, not only for applications.
Summary based on the full text. Read the original for the full argument and data.Read the original on wiz.io