PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research discovered a set of critical memory-safety flaws in the core PHP engine - grouped under CVE-2026-109618 and CVE-2026-109619 and scored up to CVSS 9.2 - that enable unauthenticated remote code execution and process-memory disclosure across PHP releases back to 5.4. The root causes are use-after-free and type-confusion bugs that arise when PHP handles fatal errors (notably out-of-memory conditions) during early request processing, such as upload-progress and backtrace handling. The team combined these primitives into a single exploit, php2shell, and demonstrated pre-auth RCE on WordPress, Drupal and Joomla container images, as well as the ability to read in-process secrets (passwords, tokens, API keys). PHP released a patch on October 21, 2026; until systems are updated, defenders should watch for unusual multipart requests, memory-limit errors, repeated HTTP 500s, malformed PHPSESSID cookies, and unexpected PHP worker churn.

The research highlights an AI inflection point: frontier large language models and testing tools materially reduced the effort to chain and adapt complex memory exploits across differing PHP versions and memory layouts, turning longstanding but impractical flaws into reliable attacks. The discovery and coordinated disclosure involved PHP maintainers, major cloud and CDN providers, and AI vendors (Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas). Immediate patching is the only complete remediation; vendors provided mitigations and detection guidance for organizations unable to update right away.