Key highlights:
- Wiz Research identified critical PHP2Shell vulnerabilities that could enable unauthenticated remote code execution and expose sensitive process memory.
- The flaws affect PHP versions dating back to 5.4 and are grouped under CVE-2026-109618 and CVE-2026-109619.
- PHP released security patches on October 21, 2026, after researchers, developers, and major technology companies worked together.
- Frontier AI models helped researchers discover the flaws and develop working exploits, highlighting how AI can accelerate both vulnerability research and potential cyberattacks.
A new set of PHP vulnerabilities is raising concerns about the security of websites and servers that rely on PHP. Wiz Research discovered these problems in PHP’s core engine, so even if your web app code is secure, a vulnerable PHP version still puts you at risk.
The research also shows how fast the world is changing. With advanced AI, Wiz could track down memory bugs that had been in PHP code for over ten years. They found exploits that let them run remote code without logging in, forcing urgent action across the tech industry.
Critical PHP Flaws Could Expose Servers to Remote Attacks
PHP runs much of the web, including platforms like WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki. Wiz says about 70% of all websites use PHP. That means a core PHP flaw isn’t just a technical issue, it’s a huge security threat. The problem stems from how PHP handles fatal errors, especially when a server runs out of memory. In some cases, PHP fails to clear internal memory references after an error. When the next process starts, an attacker could steal secret information or even tamper with core data.
These bugs (CVE-2026-109618 and CVE-2026-109619) score a 9.2 out of 10 for severity. They date back to PHP 5.4, so that’s about a decade of versions with at least one serious security hole. What could go wrong? Hackers might steal passwords, authentication tokens, API keys, or certificates that live in memory. In worse cases, hackers can use memory corruption to plant their own code on servers running these PHP versions.
Exclusive: AI just found one of the most severe online bugs ever. It puts up to 70% of the world’s websites at risk. https://t.co/nVnN8vs5QH
— The Wall Street Journal (@WSJ) October 22, 2026
Exploits Demonstrated Against Major Website Platforms
Wiz combined the new vulnerabilities into an exploit called php2shell and showed that it could hack into WordPress, Drupal, and Joomla, all using the latest official versions at the time. What matters is that the vulnerabilities are in PHP itself, not in how someone built their site. So even if your app code is spotless, you’re exposed if you don’t patch your PHP. The team also showed it was possible to grab sensitive PHP worker memory without running code first.
In their work, Wiz found four key bugs that hackers could use: an upload-progress unserializer use-after-free bug, a remote process-memory disclosure bug, a fatal-error backtrace use-after-free bug, and an OPcache type-confusion problem.
Each one misuses memory or state in a slightly different way. Some affect single PHP workers, but the OPcache bug affects state shared among multiple workers. While Wiz tested key attack routes, they also warned that other related weaknesses could still exist in the codebase.
Since these attacks happen deep in the engine, most web app logs won’t catch them. Wiz suggested defenders look for odd multipart requests followed by out-of-memory errors, lots of HTTP 500 errors, weirdly large or broken PHPSESSID cookies, and sudden PHP worker restarts.
AI Changes the Effort Required to Develop Exploits
These bugs had been sitting in PHP for more than a decade. Pulling them together for a live hack took significant technical work. The researchers had to chain several bugs, understand memory issues, and tweak code for differences between PHP versions and settings.
Wiz said frontier AI models made the process practical by helping with vulnerability discovery, exploit development, debugging, detection, and patch validation. They used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. The report says Gemini 4 Argon made a huge difference.
This is a big deal for defenders and attackers. AI now helps reduce the time and expertise needed to modify attack code for multiple environments. On the other side, security researchers are using the same power to find problems that humans alone have missed for years.
Wiz found the first bug on August 19, 2026. They proved they could hack Drupal without logging in on August 20, and did the same to WordPress on August 21. They reported the bugs to PHP security on August 24. PHP acknowledged the issue on September 21 and began working on patches. The fixed versions were released on October 21, along with a public announcement.
It wasn’t done in isolation; Wiz, the PHP developers, Calif, OpenAI, and tech giants like AWS, Google Cloud, Cloudflare, Microsoft, Akamai, Fastly, Imperva, Automattic, and Vercel teamed up. They issued advice, detection tools, and ways to help organizations that can’t patch right away.
Wiz said the best fix is to update PHP to the latest patch; there’s no substitute for patching. Wiz customers can check the Threat Intel Center advisory for more help. Sensor customers using version 1.0.12768 can also use a built-in response policy to kill processes that show signs of PHP2Shell attacks.
