Wiz Research and the firm Calif, using Gemini 4 Argon and GPT-5.6 Sol, found two critical flaws in the PHP core, the language behind roughly 70 percent of all websites. The PHP Foundation patched them on 21 October 2026. The NSA advised pulling unpatchable servers offline.
Key takeaways
- Two CVEs, CVE-2026-109618 and CVE-2026-109619, top CVSS score 9.2
- Unauthenticated RCE?RCE: remote code execution on a server, with no login and no privileges demonstrated against WordPress, Drupal and Joomla
- Every PHP release from 5.4 onward is affected, 8.5.12 is safe
- Wiz used three AI tools: Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol
The bug sits in the engine, not the application
Both flaws are memory-safety issues in how PHP handles out-of-memory failures mid-request. An aborted request leaves corrupted state that the same worker?worker: a single server process that handles incoming requests one after another reuses on a later request.
Wiz chained them into php2shell and achieved unauthenticated code execution against current WordPress, Drupal and Joomla images. The flaw sits below the application layer, so even a "Hello World" app on unpatched PHP is exposed. A second path reads passwords, tokens and API keys from worker memory.
The diagram follows the sequence described in Wiz's report. It does not show memory-layout details or the second path, which is used to read secrets.
What the AI actually did
Wiz does not claim a model found the bug alone. The team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol for discovery, exploit development and patch validation. Calif separately found one flaw with GPT-5.6 Sol, inside OpenAI's "Patch the Planet" programme.
| Date | Event |
|---|---|
| 19 August | Wiz finds the first flaw |
| 20 August | Drupal RCE confirmed |
| 24 August | reports handed to the PHP team |
| 20 October | CVE IDs leak onto forums |
| 21 October | the PHP Foundation ships patches, a day early |
For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex.
Raluca Ada Popa, Head of Gemini Security, Google DeepMind.
The leak that moved the release forward
On 20 October the CVE IDs began circulating on forums with an inflated CVSS?CVSS: the standard scale for scoring vulnerability severity, from 0 to 10 of 10.0 instead of the actual 9.2. The PHP Foundation shipped patches a day early. Calif mistakenly published a working proof-of-concept video, and copies of the deleted clip sped up public exploit work.
Why it matters
Wiz places PHP2Shell alongside Heartbleed and Log4Shell, but with a different point: what changed is not the vulnerability, it is the economics. Exploit complexity used to be the barrier. Now a model adapts an attack to a given version and memory layout in hours. The capability cuts both ways, yet defenders must patch millions of servers while an attacker needs one.
What's next
- Only PHP 8.5.12 is a full fix, 8.1 and older are unsupported
- Wiz expects more variants of the same bug under the same two CVEs
- Cloudflare, Fastly, Google Cloud and Vercel published mitigations for unpatched servers
Sources
- Wiz Blog — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- The PHP Foundation — Today's PHP Security Release, and How We're Strengthening PHP Security
- OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities
- TechCrunch — PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet
