PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting 70% of the Internet

Wiz Research discovered multiple critical memory-safety vulnerabilities in core PHP, which affects approximately 70% of all websites globally, allowing unauthenticated attackers to achieve remote code execution (RCE) or disclose sensitive process memory.

These vulnerabilities, grouped under two CVEs (CVE-2026-109618 and CVE-2026-109619), stem from deep architectural flaws in how PHP handles fatal errors and memory allocation, and their discovery was significantly accelerated by the application of frontier AI models.

Vulnerability Overview and Impact

All disclosed PHP2Shell vulnerabilities are memory-safety issues rooted in how the core engine manages fatal errors, particularly out-of-memory conditions. These bugs leave a corrupted or stale internal PHP state that can be exploited by subsequent requests handled by the same worker process.

The impact is severe because the flaws reside in the PHP engine itself, meaning exploitation is application-agnostic. A vulnerable PHP version can be exploited even if the application running on top of it, such as WordPress, Drupal, or Joomla, is perfectly secure.

• Remote Code Execution (RCE): Attackers can achieve pre-authentication RCE on affected servers. This was demonstrated against WordPress, Drupal, and Joomla using their latest container images.
• Memory Disclosure: Attackers can read sensitive data from the PHP process's memory without achieving RCE. This memory may contain passwords, authentication tokens, API keys, and certificates belonging to other requests or the server itself.

Technical Deep Dive into PHP2Shell Bugs

The vulnerabilities exploit specific timing and state management issues within the PHP runtime. The four instances of exploitable bugs reported to PHP follow a problematic pattern related to how the engine handles request termination and memory reuse.

Upload-progress unserializer use-after-free

This bug occurs when PHP's Session module decodes session data during upload-progress handling. A fatal allocation failure can interrupt this process, destroying the request heap and leaving the unserializer's global state published. A later request can then consume this attacker-reclaimed memory, turning the stale state into a memory-corruption primitive, which was combined with memory disclosure to achieve unauthenticated RCE.

Remote process-memory disclosure

During request startup, PHP parses RFC1867 multipart requests. If an out-of-memory error aborts the request before cleanup completes, PHP may leave a session ID pointer pointing to freed memory. A subsequent multipart request handled by the same worker can access this stale pointer, causing PHP to trust the reclaimed heap contents and URL-encode them into a PHPSESSID response cookie, leading to unauthenticated memory disclosure.

Fatal-error backtrace use-after-free

In affected versions, PHP retains the backtrace of the most recent fatal error. A fatal out-of-memory error can destroy the request heap without undefining this executor-global value. If the same worker emits a diagnostic early in the next request, it can access the dangling backtrace pointer, which may point to attacker-reclaimed memory, enabling controlled memory corruption and RCE.

OPcache type confusion

OPcache persists compiled PHP structures in shared memory. An allocation failure during the persistence process can leave the process-local state advanced while the shared state still considers the memory slots available. When another worker reuses one of these slots, the stale shared metadata resolves to a pointer of the wrong type, creating a cross-worker type confusion and corrupting shared OPcache state, which was used to build an unauthenticated RCE chain against WordPress.

The AI Inflection Point in Vulnerability Discovery

Frontier AI models were critical in transforming longstanding, complex flaws into practical, scalable exploits. The underlying code flaws had existed for over a decade, but turning them into working exploits required chaining multiple bugs and adapting to the unique memory layout of each target deployment.

Pre-AI, this manual work—which involves extensive analysis, testing, and debugging across different configurations—would be extremely difficult to implement and scale. With AI, Large Language Models (LLMs) can adapt an exploit to different PHP versions, configurations, and memory layouts. This significantly lowers the barrier to scaling attacks across diverse deployments.

This development changes the economics of both vulnerability discovery and exploitation. As AI reduces the effort required to develop and adapt complex exploits, vulnerabilities that were previously considered impractical targets become viable.

Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex. We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them. (Raluca Ada Popa, Head of Gemini Security, Google DeepMind)

Responsible Disclosure and Industry Response

Wiz Research coordinated the disclosure process with the PHP team, Calif, and OpenAI. The timeline for the PHP2Shell disclosure was as follows:

• August 19, 2026: Wiz Research discovered the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
• August 24, 2026: Wiz Research reported the vulnerabilities to the PHP security team.
• October 21, 2026: Patched PHP releases became available and public disclosure occurred.

Given the widespread impact, industry partners—including Cloudflare, AWS, Microsoft, and Google—helped prepare guidance and out-of-the-box mitigations for customers who could not immediately apply the patch.

Mitigation and Defense

The only complete remediation for PHP2Shell is applying the security update released by the PHP team on October 21, 2026. Until systems are patched, defenders should monitor for specific indicators of compromise (IOCs) that suggest exploitation attempts:

• Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses.
• Unexpectedly large or malformed PHPSESSID response cookies.
• Unexplained PHP worker churn.

Defenders should refer to the Wiz Threat Intel Center advisory for built-in coverage for agentless and runtime vulnerability detection and exploitation detection via Wiz Defend and Sensor.