PHP2Shell: critical PHP flaws patched after AI-assisted discovery
Wiz Research disclosed two critical vulnerabilities in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, involving memory disclosure and unauthenticated remote code execution; Wiz says every PHP version released in the last decade, back to 5.4, is affected. PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, with both flaws rated CVSS 9.2, while OpenAI said it coordinated with PHP maintainers, Wiz, Cloudflare and others over roughly two months. OpenAI said Calif researcher Ryan Austin identified a critical flaw using GPT-5.6 Sol under its Patch the Planet initiative, with Wiz independently discovering and reporting both flaws; Calif later said Austin was the first to find and exploit the flaw, with AI compressing verification rather than supplying direction.
The vulnerabilities sit in PHP itself, which Wiz says powers 70% of websites, so remediation touches WordPress, Drupal and other PHP-based platforms; OpenAI has said such findings are only part of many major vulnerabilities it expects to rise sharply in coming months.
Executive Summary
- Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.
- PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.
- These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk.
- Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.
- On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine.
- These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
#PHP#OpenAI#Wiz#Calif#Cloudflare#GPT-5.6 Sol#Gemini 4 Argon#Wiz Atlas#Ryan Austin