Wiz Research disclosed a set of critical remote code execution flaws in PHP's core engine on Wednesday and said AI models, led by Google's Gemini 4 Argon, did much of the work of finding and exploiting them. The bugs, which Wiz calls PHP2Shell, affect nearly every PHP release going back to version 5.4, and Wiz estimates 70% of the Internet is exposed. PHP published patched releases the same day.
The flaws are tracked under two CVEs with severity reaching CVSS 9.2. CVE-2026-109618 is a use-after-free in PHP's upload-progress unserializer that allows remote disclosure of process memory and, chained with other bugs, code execution. CVE-2026-109619 covers a use-after-free in fatal-error backtraces and an OPcache type confusion, both of which lead to code execution. Wiz said every PHP version released in the last decade carries at least one of the flaws.
All of the issues trace back to how PHP handles fatal errors, especially out-of-memory errors. A request that fails can leave corrupted internal state behind, and a later request on the same worker reuses it. Wiz said the four bugs it reported are instances of one pattern and that other variants likely exist, but that PHP's fix addresses the root cause and eliminates those variants.
Key facts
- 01Wiz Research disclosed PHP2Shell, critical PHP core flaws tracked as CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2.
- 02Nearly every PHP version back to 5.4 is affected; Wiz estimates 70% of the Internet is exposed.
- 03Wiz says one researcher using Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas did in a week what would have taken a top team months.
- 04Wiz showed unauthenticated remote code execution against WordPress, Drupal and Joomla container images.
- 05PHP released patched versions on October 21, 2026, after Wiz reported the bugs on August 24.
Wiz demonstrated unauthenticated remote code execution against the then-latest container images of WordPress, Drupal and Joomla, and combined the bugs into a single exploit script called php2shell. The memory-disclosure flaw is a separate problem: it can leak passwords, tokens and API keys from worker memory without any code execution, and it works even if an application never calls session_start(). Because the vulnerable code lives in PHP itself, even a simple application on an affected version can be exposed.
The AI angle is speed. Wiz used its own Wiz Atlas alongside Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and credited Gemini 4 Argon as a key contributor to the discovery. The models were also used to adapt exploits to different PHP versions, configurations and memory layouts, working through testing and debugging tools to analyze failures and iterate, and to support attack detection and validate the patch. Wiz said a single researcher completed in a week what previously would have taken a world-class team months of work.
“Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense.”— Raluca Ada Popa, Head of Gemini Security, Google DeepMind
Wiz also pointed out the other side of that capability: the same ability to adapt exploits across many deployments lowers the barrier to scaling attacks.
The disclosure followed a two-month coordinated process. Wiz found the first vulnerability on August 19, confirmed unauthenticated code execution against Drupal on August 20 and WordPress on August 21, and reported the issues to the PHP security team on August 24. PHP acknowledged the reports on September 21 and began building a fix, which shipped alongside public disclosure on October 21.
Applying the PHP security update is the only complete remediation, according to Wiz. For customers who cannot patch immediately, Cloudflare, Fastly, Google, AWS, Microsoft, Akamai, Imperva and Vercel have published guidance or out-of-the-box mitigations, and Wiz Sensor version 1.0.12768 includes a response policy that terminates processes showing PHP2Shell-like behavior.
For teams hunting for exploitation attempts, Wiz lists unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unusually large or malformed PHPSESSID cookies, and unexplained PHP worker churn as indicators to watch.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
