Wiz discloses severe PHP core vulnerabilities and publishes a brief

1. 10:33
   XX @gdb· Discussion

   learn about php2shell and the general emerging security landscape:(opens the original post in a new tab)

1. 06:07
   X@girl_coder_MV· Discussion

   If you code in PHP, this may be helpful 🙃 https://www.wiz.io/blog/php2shell-php-rce #code #PHP #PHP2Shell #WebDev…(opens the original post in a new tab)
2. 03:14
   X@InfraWatchHQ· Discussion

   Wiz confirms working pre-authentication remote code execution against WordPress and Drupal via PHP2Shell, so CMS sites…(opens the original post in a new tab)
3. 00:19
   X@bynar_io· Discussion

   You've probably seen plenty about PHP2Shell by now: two critical PHP vulnerabilities, potential unauthenticated RCE, an…(opens the original post in a new tab)
4. 00:09
   X@AIEngineerHub· Discussion

   🚨 𝗣𝗛𝗣𝟮𝗦𝗵𝗲𝗹𝗹: 𝗔 𝗻𝗲𝘄 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗻𝗶𝗴𝗵𝘁𝗺𝗮𝗿𝗲? Germany’s Federal Office for Information Security (BSI) has issued an urge…(opens the original post in a new tab)

1. 21:28
   X@samilaiho· Discussion

   PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet https://www.wiz.io/blog/php2shell-php…(opens the original post in a new tab)
2. 19:31
   X@wesselvk· Discussion

   Source: Wiz Research, OpenAI and PHP, 21 Oct https://www.wiz.io/blog/php2shell-php-rce(opens the original post in a new tab)
3. 17:23
   X@donder172· Discussion

   @TimmyTangoVT @Pirat_Nation No, this is much more recent. And so much worse. https://www.wiz.io/blog/php2shell-php-rce(opens the original post in a new tab)
4. 15:34
   X@elhackernet· Discussion

   Demonstrations of PHP2Shell with Wordpress, Joomla, and Drupal: https://www.wiz.io/blog/php2shell-php-rce WordPress Pr…(opens the original post in a new tab)
5. 15:12
   WebAI Threat Watch (aithreat.io)· Media coverage

   PHP2Shell : l'IA est à l'origine de la découverte de la faille qui ébranle le Web(opens the original post in a new tab)
6. 12:57
   X@NewsLesender· Discussion

   @Loewin_mit_Herz @KI_Agent Nachzulesen hier https://www.wiz.io/blog/php2shell-php-rce es wurde geuielt gesucht und wie…(opens the original post in a new tab)
7. 10:25
   X@k1oku· Discussion

   PHP2Shell: AI discovers a critical remote code execution (RCE) vulnerability affecting 70% of the internet https://www.wiz.io/blog/php2shell-php-rce(opens the original post in a new tab)
8. 08:31
   X@kponda· Discussion

   About the PHP vulnerability—Wiz has released a detailed report https://www.wiz.io/blog/php2shell-php-rce(opens the original post in a new tab)
9. 06:31
   X@coplusofficial· Discussion

   Wiz's investigation blog (in English). The AI used, and the dates from discovery in August to publication. https://www.wiz.io/blog/php2shell-php-rce(opens the original post in a new tab)
10. 06:19
    X@moritomoya· Discussion

    A Japanese-language explanation by Wiz of the details of the PHP vulnerability; Wiz was named in the PHP Foundation's blog as one of the companies that discovered and reported the issue. I'm grateful for the Japanese. PHP2Shell: AI discovers a critical RCE vulnerability affecting 70% of the internet…(opens the original post in a new tab)

1. 21:59
   Wiz ResearchSelected

   PHP2Shell: Wiz uses AI to find a severe RCE vulnerability affecting 70% of websites on the internet

   Wiz Research found multiple severe memory safety vulnerabilities in the PHP core that underpins 70% of the world's websites, and PHP released patches on October 21, 2026. The vulnerabilities are classified into two CVEs (CVE-2026-109618, CVE-2026-109619), with a maximum CVSS of 9.2, and almost all PHP versions, including 5.4, are affected by at least one of them. Wiz combined the vulnerabilities into the php2shell attack chain and demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla, as well as the ability to read sensitive data such as passwords and tokens in process memory, with exploitation not depending on flaws in application code. These defects have existed for more than a decade, and the exploitation threshold was previously close to the limit of human researchers; the authors said that with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, one researcher completed in a week work that previously took top teams months.

2. 21:41
   X@galnagli· Discussion

   As the embargo is now lifted, find all the information needed on https://php2shell.com/ - the critical RCE vulnerabilit…(opens the original post in a new tab)
3. Time not given
   Wiz Research

   PHP2Shell emergency threat brief: Wiz Research analyzes PHP unauthenticated RCE vulnerabilities

   Wiz Research released an emergency threat brief on PHP2Shell, explaining two critical PHP vulnerabilities it discovered and responsibly disclosed that can lead to unauthenticated RCE. The vulnerabilities affect widely used PHP versions (including older versions that no longer receive patches) and could affect WordPress, Drupal and MediaWiki. The brief also covers the discovery process of AI-driven security research and mitigation options for systems that cannot be patched immediately.

Current attention 36·Peak in the comparable period 46 (Oct 23 13:00)·Change over the comparable past 24 hours 0%