Wiz Research, working with Google DeepMind, OpenAI, and Calif, has disclosed two CVEs (CVE-2026-109618 and CVE-2026-109619) in core PHP that enable unauthenticated remote code execution and memory disclosure on any affected server. The vulnerabilities are not in WordPress, Drupal, or Joomla — they are in PHP itself. Even a bare 'Hello World' app running on a vulnerable version is exploitable. Every PHP release back to version 5.4, spanning over a decade of releases, carries at least one of these flaws. The bugs are memory-safety issues in how PHP handles fatal errors, particularly out-of-memory conditions, during request processing. When a fatal allocation failure interrupts session decoding or backtrace generation, the request heap is destroyed but stale internal state persists. A subsequent request handled by the same worker process can then consume attacker-reclaimed memory as live bookkeeping, yielding a corruption primitive. Combined with a memory disclosure step to defeat address randomization, the researchers chained these into full unauthenticated RCE against WordPress, Drupal, and Joomla running their latest container images. The critical inflection point is AI. The vulnerable code existed for more than a decade, but building a working exploit required chaining multiple bugs and adapting to each target's specific memory layout — a process that demanded deep specialist knowledge and extensive manual iteration. Wiz used Gemini 4 Argon, GPT-5.6 Sol, and their own Wiz Atlas to discover the vulnerability, develop the exploit, detect attacks, and validate the patch. The team reports that frontier models reduced the adaptation cycle for each new target from what would have been weeks of specialist work to hours. The severity is extreme. CVSS scores reach 9.2. Attackers who exploit the memory disclosure variant can read passwords, authentication tokens, API keys, and certificates from the PHP worker's memory without achieving full code execution — a lower bar that still yields devastating results. The RCE variant gives complete server control. The researchers note additional tracked and likely untracked variants of the same pattern exist in the PHP codebase, though the October 21 patch addresses the root cause and eliminates all known variants. The coordinated disclosure effort was unusually broad, reflecting the blast radius. Before public release, Wiz partnered with Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and others to prepare out-of-the-box mitigations for organizations that cannot patch immediately. PHP runs across clouds, hosting providers, CDNs, and millions of independently managed servers — a supply chain that makes universal patching slow and incomplete. Wiz draws explicit parallels to Heartbleed (2014) and Log4Shell (2021), framing PHP2Shell as a turning point for the AI era. The argument is structural: complexity was the last barrier protecting latent vulnerabilities in critical infrastructure. When AI compresses the exploit-development cycle from months of specialist effort to hours of model-assisted iteration, the population of 'practically exploitable' bugs expands dramatically. The question is no longer whether a flaw can theoretically be chained into an exploit — it's whether a model can do the chaining. The patch is available. The unpatched surface is vast. PHP powers roughly 70% of websites globally, and the long tail of self-managed servers, legacy hosting, and embedded deployments means a significant fraction will remain vulnerable for months or years. The race between patching and exploitation is already underway.
