PHP2Shell: AI finds critical RCE vulnerabilities affecting 70% of websites worldwide
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Wiz Research disclosed multiple critical memory-safety vulnerabilities in PHP core, classified as CVE-2026-109618 and CVE-2026-109619, with a maximum CVSS of 9.2, which can lead to unauthenticated remote code execution and disclosure of process memory information; PHP released patches on October 21, 2026. PHP powers 70% of websites worldwide, every version released in the past decade is affected by at least one vulnerability, the earliest dating back to PHP 5.4, and the vulnerabilities lie in PHP itself, unrelated to upper-layer applications. The team combined the vulnerabilities into the php2shell exploit script and demonstrated unauthenticated RCE on the latest container images of WordPress, Drupal and Joomla, and was able to read sensitive data such as passwords, authentication tokens and API keys in process memory. Wiz completed coordinated disclosure with the PHP team, Calif and OpenAI.
A frontier model chained a PHP memory flaw that has existed for over a decade into an unauthenticated RCE exploit chain; the authors say this changes the economics of vulnerability discovery and exploitation.