Memory flaws hidden in the PHP core engine for over a decade were turned into working remote attack chains with help from frontier models. On October 21, 2026, Wiz Research publicly disclosed the vulnerability group dubbed PHP2Shell, and the PHP team released fixes the same day. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, with a top severity score of 9.2. Nearly every PHP release of the last decade is hit by at least one of them, going back to version 5.4.
The bug is in the language, not in website code
PHP powers about 70% of the world's websites, including WordPress, Drupal, Joomla, and MediaWiki, the software behind Wikipedia. The problem lies in how PHP handles fatal errors, especially out-of-memory errors: a request that dies unexpectedly can leave corrupted internal state behind, and a later request reusing that state can read process memory or go further and execute arbitrary code. Wiz demonstrated unauthenticated remote code execution on current WordPress, Drupal, and Joomla images, as well as reading server process memory without code execution — memory that may hold passwords, tokens, and certificates from other requests. In short, even perfectly written site code stays exposed while the PHP underneath remains unpatched.
AI lowered the exploitation barrier, not just discovery time
The vulnerable code sat there for more than a decade. One reason it was never exploited at scale is that chaining memory bugs into a stable exploit is painstaking work that must be adapted to each version and memory layout. Wiz says its research used its own tooling plus frontier models including Gemini 4 Argon and GPT-5.6 Sol for discovery, exploit development, detection, and patch validation, while OpenAI's Patch the Planet initiative also took part in pre-disclosure discovery and coordination. A single researcher finishing in about a week what once took a world-class team months is the real warning here: judging an old bug's danger can no longer rest on how hard it is to exploit, because models are driving that cost down.
For site operators, one task outranks the rest
Upgrading to a fixed official PHP release is the only complete remedy, and every delay raises the chance that public details get rebuilt into general-purpose tools. Environments that cannot upgrade yet can lean on mitigations prepared by cloud and hosting providers before disclosure, watch for abnormal large multipart uploads followed by memory-limit errors and repeated 500 responses or frequent PHP worker restarts, and schedule the upgrade window as soon as possible. A component nobody touched for a decade is not automatically safe — this time it was PHP; next time it could be any shared foundation of the web.
