PHP2Shell: Wiz uses AI to find a severe RCE vulnerability affecting 70% of websites on the internet

Wiz Research found multiple severe memory safety vulnerabilities in the PHP core that underpins 70% of the world's websites, and PHP released patches on October 21, 2026. The vulnerabilities are classified into two CVEs (CVE-2026-109618, CVE-2026-109619), with a maximum CVSS of 9.2, and almost all PHP versions, including 5.4, are affected by at least one of them. Wiz combined the vulnerabilities into the php2shell attack chain and demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla, as well as the ability to read sensitive data such as passwords and tokens in process memory, with exploitation not depending on flaws in application code. These defects have existed for more than a decade, and the exploitation threshold was previously close to the limit of human researchers; the authors said that with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, one researcher completed in a week work that previously took top teams months.