Wiz uses AI to find PHP2Shell, a PHP security vulnerability that has existed for over 10 years

The PHP development team fixed two vulnerabilities codenamed PHP2Shell (CVE-2026-109618, CVE-2026-109619) on October 21, and Wiz, which reported the vulnerabilities, published the discovery process the same day. The vulnerabilities can be traced back to PHP 5.4, released in 2012. In late August, Wiz used top AI models such as Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to find the vulnerabilities, verified them on WordPress, Drupal, and Joomla, and received confirmation from PHP. Wiz said that manually verifying whether a vulnerability can actually be used in an attack was originally extremely difficult, and that top AI models greatly eliminated the related obstacles, turning long-standing software defects into exploitable security weaknesses, and called PHP2Shell the most severe vulnerability in PHP's history. Wiz emphasized that the vulnerabilities exist in PHP itself, so even running a Hello World application may leave users exposed; in addition to remote code execution, attackers can also read passwords, tokens, and API keys in process memory.