PHP2Shell: AI Uncovers Critical RCE Vulnerabilities in the PHP Engine

PHP2Shell: What happened?

On October 21, 2026 Wiz Research (owned by Alphabet) published details of PHP2Shell. The finding is a collection of critical vulnerabilities inside the PHP engine itself. The flaws allow unauthenticated remote code execution and sensitive memory disclosure on servers that run vulnerable PHP versions.

The difference from a typical CMS bug is that the problem lives in PHP, not in WordPress, Drupal, Joomla or your own application code. If the server runs an affected PHP version the platform is exposed no matter how hard you harden the application layer.

Wiz rates the severity at CVSS 9.2 and notes the bugs date back to PHP 5.4, more than a decade of possible exposure. PHP released security updates the same day as the public disclosure.

---

Why PHP2Shell Is Dangerous

The demonstrations prove the underlying PHP flaws are exploitable. They do not mean every WordPress, Drupal or Joomla installation has been compromised. Actual exposure depends on PHP version, configuration and whether vendor patches are applied.

---

How the Vulnerabilities Work (High Level)

The root cause is memory‑safety problems in how PHP handles fatal errors and out‑of‑memory conditions.

Simplified flow:

1. PHP hits a fatal allocation failure while processing a request.
2. The request ends but internal state still points to memory that has been freed.
3. A later request handled by the same worker touches that stale state.
4. Under the right conditions an attacker turns the resulting memory corruption or disclosure into an exploit.

Wiz groups the issues under two CVEs:

Wiz describes four exploit primitives across these CVEs and warns more variants may exist. The PHP patches fix the underlying root causes rather than only blocking the demonstrated chains.

---

The AI Factor: Why This Matters Beyond the Patch

One of the most significant aspects of PHP2Shell is how it was discovered.

• The underlying flaws existed for over a decade. They were hard to exploit reliably — doing so required deep expertise in PHP memory management and internal architecture.
• AI changed the economics. Wiz used Wiz Atlas, Gemini 4 Argon and GPT‑5.6 Sol during research. The team credits Gemini 4 Argon with a particularly large contribution across vulnerability discovery, exploit development, detection and patch validation.
• AI accelerated exploit adaptation. Researchers used it together with testing and debugging tools to adjust techniques for different PHP versions, configurations and memory layouts.
• Double‑edged sword: AI helps defenders find long‑standing bugs, but it also lowers the specialist expertise and effort attackers need to weaponize them.

Wiz argues that AI changes the practical threat posed by vulnerabilities that once seemed too difficult or expensive to exploit reliably. Complexity is no longer a reliable shield.

---

Remediation and Mitigation

1. Update PHP Immediately (Primary Response)

• Linux distribution packages: check for vendor updates and security backports.
• PHP 8.1 and older no longer receive ordinary upstream security updates. Prioritize migration or vendor extended support.

2. Temporary Mitigations (If Patching Is Delayed)

The PHP advisory recommends measures that reduce exposure to specific attack paths:

• Disable session upload‑progress handling.
• Review memory limits, request‑size limits and fatal‑error handling.

These are partial mitigations, not a substitute for a security update.

3. Investigation Signals

Wiz highlights the following as potential indicators of exploitation attempts:

• Unusual multipart HTTP requests followed by memory‑limit errors or repeated HTTP 500 responses.
• Unexpectedly large or malformed PHPSESSID cookies.
• Unexplained PHP worker churn.

These indicators are not proof of exploitation on their own; they warrant investigation.

---

Coordinated Industry Response

Wiz coordinated disclosure with the PHP security team and major infrastructure players:

OpenAI, Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel

The collaboration covered coordinated disclosure, patch verification, detection rules and mitigations for organizations unable to update immediately. This illustrates the difficulty of addressing a vulnerability in widely deployed infrastructure. The response spans hosting providers, cloud platforms, application operators and software maintainers.

---

Disclosure Timeline

Source: Wiz PHP2Shell report.

---

The Broader Lesson

PHP2Shell is not just another critical PHP vulnerability. It sits at the intersection of:

1. Widely deployed infrastructure software (PHP powers a huge fraction of the web).
2. Long‑lived memory‑safety flaws (over a decade in the codebase).
3. AI‑assisted exploit development (dramatically lowering the effort to weaponize).

For defenders: AI is a powerful tool to uncover old weaknesses in your own stack. Use it.

For everyone: The era where exploit complexity bought time is ending. When a memory‑safety bug in a core component can be reliably weaponized with AI assistance, patching speed and defense‑in‑depth become even more critical.

---

References

• Wiz Research full technical report: https://www.wiz.io/blog/php2shell-ai-uncovers-critical-rce-vulnerabilities
• Official PHP security announcement: https://www.php.net/security