Security firm Wiz Research disclosed a set of critical vulnerabilities in the core PHP engine on October 21, 2026, warning that the flaws — collectively dubbed PHP2Shell — enable unauthenticated remote code execution and Heartbleed-style memory disclosure on the software that powers an estimated 70 percent of all websites. The PHP project released patches the same day, and Wiz is urging immediate updates across the web's enormous installed base.
PHP is the backbone of much of the internet: it powers WordPress, Joomla, Drupal and MediaWiki, the software that runs Wikipedia. Crucially, the newly disclosed bugs live in PHP's core engine, not in any application built on top of it, meaning sites can be exposed even when their own application code is secure. For more context on this story, see our ongoing AI news.
What the Vulnerabilities Are
According to Wiz's technical write-up by researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, all of the disclosed bugs are memory-safety issues rooted in how PHP handles fatal errors during request processing — particularly out-of-memory errors. A crashed request can leave corrupted internal PHP state behind, and a later request or worker that reuses that stale state can trigger memory disclosure or memory corruption.
The findings were grouped under two CVEs with a maximum severity of CVSS 9.2:
- CVE-2026-109618 — an upload-progress unserializer use-after-free that an attacker can leverage for remote process-memory disclosure and, in demonstrated chains, full remote code execution. Wiz demonstrated unauthenticated disclosure of PHP worker memory and pre-authentication RCE on WordPress, Drupal and Joomla.
- CVE-2026-109619 — a fatal-error backtrace use-after-free combined with an OPcache type confusion, also demonstrated to yield pre-authentication remote code execution on Drupal and WordPress.
Memory that attackers can read may contain passwords, authentication tokens, API keys and certificates belonging to other requests or to the server itself, Wiz said. Every PHP version released in the last decade — going back to PHP 5.4 — is affected by at least one of the vulnerabilities, and the company says these rank among the most severe flaws ever found in PHP.
Where AI Comes In
The most consequential claim in Wiz's report is not about PHP at all — it is about what frontier AI models have done to exploit development.
The underlying flaws, Wiz writes, had been present for decades, but proving exploitability required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." The exploit had to chain multiple flaws and adapt to each target's memory layout through repeated testing and debugging.
Frontier AI models, the company says, substantially reduced that barrier — "turning a longstanding flaw into an exploit" — and enabled Wiz's team to develop and adapt working exploits across multiple applications in hours rather than weeks.
"As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice," the researchers wrote.
A Turning Point in the AI Era?
Wiz explicitly frames PHP2Shell alongside two earlier watershed moments in web security: Heartbleed in 2014, which exposed the fragility of the shared infrastructure securing the internet, and Log4Shell in 2021, which revealed how deeply embedded software dependencies create widespread exposure. The company argues PHP2Shell could mark a similar turning point — this time illustrating how AI changes the practical exploitability of long-known weaknesses.
That framing matters beyond PHP. Theoretical vulnerabilities that were safely out of reach because exploiting them was too hard, too slow or too specialized may now be within reach of well-resourced attackers armed with AI tooling — a shift with obvious implications for defense budgets, patch cadences and disclosure timelines across the software industry.
A Coordinated Cross-Industry Fix
The disclosure was coordinated. Wiz thanked the PHP team and OpenAI for their work on discovery, coordination and patch verification, noting that both OpenAI and PHP published their own technical write-ups of the vulnerability's history and disclosure process.
A cross-industry group — including Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel — prepared guidance and out-of-the-box mitigations for customers who cannot patch immediately. Cloudflare separately announced on October 21 that it has deployed WAF protections against the PHP vulnerabilities for its customers.
What Site Owners Should Do
The advice from Wiz is blunt: patch immediately. The PHP project released fixes for the memory-safety vulnerabilities on October 21, 2026, and every supported PHP deployment should update as soon as possible.
Organizations that cannot patch right away should apply the mitigations published by their CDN, hosting or WAF providers, several of which shipped rules targeting the exploit chains on day one. Administrators of WordPress, Drupal and Joomla fleets should treat this as a priority patch cycle: Wiz demonstrated pre-authentication remote code execution against all three platforms, and the vulnerable code paths exist regardless of how well-maintained the applications above them are.
The deeper lesson may be the one Wiz itself drew: when AI can compress months of exploit engineering into hours, the industry's working definition of "practically exploitable" — and with it, the meaning of responsible patching timelines — has just changed.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
