PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Wiz Research discovered critical remote code execution (RCE) and memory disclosure vulnerabilities in PHP's core engine, collectively dubbed 'PHP2Shell', affecting nearly all PHP versions released in the last decade, including PHP 5.4 and later. The vulnerabilities stem from memory-safety issues related to how PHP handles fatal errors during request processing, enabling unauthenticated attackers to achieve remote code execution or read sensitive process memory containing passwords, tokens, and API keys. Exploitation is application-agnostic and affects any PHP-based application, including WordPress, Drupal, and Joomla, even with secure application code. The vulnerabilities were responsibly disclosed and patched on October 21, 2026, with AI models playing a key role in both discovery and exploit development.

AI-extracted · verify before operational use