PHP2Shell: Wiz says AI helped find critical remote code flaws in PHP

Flaws in PHP itself, not in applications

According to Wiz, PHP powers 70% of all websites in the world, including WordPress, Joomla, Drupal and Wikipedia's MediaWiki. The reported vulnerabilities sit in the core engine, independent of the application running on top of it. Wiz says that even a simple "Hello World" application on an affected PHP version can be vulnerable.

The issues were grouped under two CVEs, with severity reaching CVSS 9.2. Wiz says every PHP version released in the last decade is affected by at least one of them, going back to version 5.4. Successful exploitation could let attackers take control of servers, steal sensitive data and deface websites. Wiz also says the flaws can be exploited remotely, in some cases fairly easily.

An attacker could also read process memory without achieving code execution. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself, according to Wiz.

How the bugs work

Wiz describes all the disclosed flaws as memory-safety issues that stem from how PHP handles fatal errors during request processing, particularly out-of-memory errors. Such errors can leave a corrupted internal state behind after a request ends unexpectedly. A later request or worker can reuse that stale state, which leads to memory disclosure or corruption.

Wiz reported four exploitable bugs to PHP:

• CVE-2026-109618: an upload-progress unserializer use-after-free, which allows remote process-memory disclosure and, per Wiz, code execution. Wiz demonstrated pre-authentication RCE on WordPress, Drupal and Joomla.
• CVE-2026-109619: a fatal-error backtrace use-after-free and an OPcache type confusion, which let an attacker corrupt process or shared PHP state and execute code. Wiz demonstrated pre-authentication RCE on Drupal and WordPress.

Wiz combined the bugs into one exploit script, php2shell, and tested it against the latest container images of WordPress, Drupal and Joomla at the time. It adds that other tracked and likely untracked variants exist, but says the PHP patch fixes the issue at its core and eliminates all variants in the patched release.

The role of AI

Wiz says the underlying flaws had been present for decades, but proving they were exploitable required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Exploits must chain several bugs and adapt to each target's memory layout, PHP version and configuration, which normally demands repeated testing and debugging.

According to Wiz, frontier models made this practical, allowing the team to develop and adapt working exploits across multiple applications in hours. The company used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and says Gemini 4 Argon contributed to finding the vulnerability, exploit development, attack detection and patch validation.

Wiz compares the case to Heartbleed in 2014 and Log4Shell in 2021, and says PHP2Shell could mark a similar turning point for the AI era. It argues that as the time and expertise needed fall, complexity may no longer be a meaningful barrier. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, is quoted as saying: "We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them."

What it means for site operators

The practical advice from Wiz is to patch immediately. For those who cannot, Wiz thanks Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel and others for preparing guidance and out-of-the-box mitigations. Wiz also credits the PHP team, Calif and OpenAI for discovery, coordination and patch verification, and notes that OpenAI, Calif and PHP published their own posts with technical details.

Wiz customers are pointed to its Threat Intel Center advisory, which covers vulnerability detection, exploitation detection and response policies. Because the flaws are in PHP itself, secure application code does not by itself protect a site, so the PHP version in use is what matters.