PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research used frontier AI models to discover critical remote code execution vulnerabilities in PHP's core engine affecting versions 5.4 and later. The flaws, hidden for over a decade, involve memory-safety issues in fatal error handling. AI reduced complexity of exploitation, enabling working exploits across WordPress, Drupal, and Joomla. PHP released patches on October 21, 2026.

Why it matters

Demonstrates AI's capacity to make previously impractical exploits viable by automating complex vulnerability chain development. Affects 70% of websites globally, raising questions about how AI changes practical threat definitions.

Read with care

Source claims not independently checked; some AI model names appear inconsistent or fictional (GPT-5.6 Sol, Gemini 4 Argon); exploit complexity and AI contribution details unverified.