Cybersecurity researchers at Wiz have uncovered critical vulnerabilities in PHP, the programming language that powers a large portion of the internet. Dubbed PHP2Shellthe flaws could allow attackers to execute malicious code on vulnerable servers without authentication, potentially exposing sensitive information and giving attackers control over affected systems.
Disclosed on October 21, 2026, the vulnerabilities affect PHP itself rather than a particular website or content management system. This makes the discovery especially significant because PHP underpins widely used platforms such as WordPress, Drupal and Joomla.
What Is PHP2Shell?
PHP2Shell refers to two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both involve memory-safety problems in PHP’s handling of errors, particularly when requests terminate unexpectedly because of memory exhaustion or fatal errors.
Under certain conditions, PHP can retain pointers to memory that has already been freed or leave internal data in an inconsistent state. A subsequent request may then exploit this condition to corrupt memory, disclose sensitive information or execute code remotely.
The vulnerabilities have been assigned a critical severity score of CVSS 9.2. Successful exploitation could expose passwords, authentication tokens, API keys and other sensitive information held in server memory.
Why Could Millions of Websites Be Affected?
PHP powers an estimated 70% of websites worldwide, according to Wiz’s research. The vulnerability exists in the PHP runtime, meaning that a website does not necessarily need to contain vulnerable application code to be at risk.
Researchers demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla deployments. They also demonstrated that attackers could extract sensitive data from PHP worker memory without first achieving code execution.
The actual exposure depends on the PHP version, server configuration and execution environment. Nevertheless, the breadth of PHP’s use makes this a serious concern for organisations operating public-facing websites.
How Artificial Intelligence Helped Discover the Flaws
One of the most significant aspects of PHP2Shell is the role of artificial intelligence in vulnerability discovery and exploit development.
Wiz researchers used Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol during their investigation. According to Wiz, AI substantially reduced the effort required to understand complex memory-management behaviour, combine multiple weaknesses and adapt exploits to different environments.
The underlying flaws had reportedly existed in PHP’s codebase for more than a decade. Exploiting them reliably required considerable technical expertise because the researchers had to account for differences in memory layouts, application behaviour and server configurations.
AI-assisted analysis helped make this complex process more practical. While the same capabilities can help defenders identify and fix hidden vulnerabilities, they could also lower the barrier for attackers seeking to exploit them.
What Should Website Owners Do?
The PHP development team released security updates on October 21, 2026. Organisations should identify every affected PHP installation and apply the appropriate vendor-provided patches immediately.
Security teams should prioritise internet-facing systems, restart PHP services after updating and verify that patched versions are running. Organisations unable to patch immediately should follow official mitigation guidance and consider restricting exposure until remediation is possible.
Administrators should also investigate unusual PHP worker crashes, repeated memory errors, suspicious multipart HTTP requests and unexpected processes launched by web server accounts. Patching does not eliminate evidence of a compromise that may already have occurred.
Web application firewalls and endpoint detection tools can provide additional protection, but they should not be treated as substitutes for installing the security updates.
A Warning About AI-Powered Cybersecurity
PHP2Shell demonstrates both the defensive potential and the risks of advanced AI systems. Tools that help researchers uncover weaknesses in widely used software can improve internet security, but they may also enable more people to develop sophisticated exploits.
For organisations that depend on PHP, the immediate priority is clear: assess exposure, patch vulnerable systems and investigate potential signs of exploitation before attackers take advantage of the public disclosure.
Summary
Wiz researchers have disclosed PHP2Shell, two critical PHP vulnerabilities that could enable unauthenticated remote code execution and sensitive data exposure. The flaws affect the PHP runtime and have been demonstrated against WordPress, Drupal and Joomla. AI tools helped researchers uncover and exploit weaknesses that had persisted for years. PHP security updates are available, making immediate patching and verification essential for affected organisations.
Image Source