PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them. PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others. These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk. Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised. On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine. These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit. Overview In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade. The issues described below all stem from key architecture decisions, some made over a decade ago, and were grouped under two CVEs, with severity reaching CVSS 9.2. The work grew into a cross-industry effort to protect customers, find variants, deploy detections and mitigations, and verify a patch in time for coordinated disclosure. Nearly every PHP version is affected by at least one of these issues, including releases dating back to PHP 5.4. The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself. PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure. Some vulnerabilities become turning points because they challenge fundamental assumptions about security. In 2014, Heartbleed exposed the fragility of shared infrastructure securing the internet. In 2021, Log4Shell revealed how deeply embedded software dependencies could create widespread exposure that organizations struggled to identify. We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities. Building the exploit required chaining multiple flaws and adapting to each target’s memory layout through repeated testing and debugging. Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours. As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice. Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification. OpenAI and Calif also published blogs containing details on the vulnerability – its history, technical details, and insight into the disclosure process. PHP posted as well. We’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations for customers who cannot apply the patch immediately. How Can Wiz Help? Wiz customers should refer to the Wiz Threat Intel Center advisory for PHP2Shell, which includes built-in coverage for agentless and runtime vulnerability detection, exploitation detection via Wiz Defend and Sensor, and automatic response policies, alongside remediation and threat hunting guidance. Sensor customers can also enable a built-in response policy to automatically terminate processes exhibiting behaviors typical of PHP2Shell exploitation: The Vulnerabilities All of the disclosed vulnerabilities are memory-safety issues that stem from bugs in how PHP handles fatal errors while processing requests, particularly out-of-memory errors. These bugs can leave a corrupted internal PHP state behind after a request ends unexpectedly. A later request or worker can reuse that stale state, leading to memory disclosure or corruption. Below you can find a table that demonstrates what type of impact was demonstrated by each of the bugs we reported to PHP. The applications listed below are targets we chose for the RCE demonstrations. They are representative targets - exploitation does not require one of these CMSs, as the vulnerable code is in PHP itself. Tracking ID Bug What an attacker can achieve What we demonstrated CVE-2026-109618 Upload-progress unserializer use-after-free Remote process-memory disclosure Corrupt process memory and execute code Unauthenticated disclosure of PHP worker memory Pre-authentication RCE on WordPress, Drupal and Joomla Application-agnostic remote memory disclosure CVE-2026-109619 Fatal-error backtrace use-after-free OPcache type confusion Corrupt process memory and execute code Corrupt shared PHP state and execute code Pre-authentication RCE on Drupal Pre-authentication RCE on WordPress While this blog covers only four instances of exploitable bugs (grouped under two CVEs) that follow this problematic pattern, there are other tracked, and likely untracked, variants of this issue in the PHP codebase. These variants have different requirements for exploitation and can lead to different types of impact. In any case, the patch provided by the PHP team fixes the issue at its core and eliminates all variants in the patched release. Impact We combined these vulnerabilities into a single exploit script, php2shell, and demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest), using their latest container images at the time of testing. These platforms illustrate the impact, but the vulnerabilities are in PHP itself. Exploitation does not depend on a flaw in the application’s code: even a simple “Hello World” application running on an affected PHP version can be vulnerable. Separately, we demonstrated that attackers could read sensitive data from the PHP process’s memory, including passwords, tokens, and API keys, without needing to achieve remote code execution. Demonstrations of PHP2Shell with Wordpress, Joomla, and Drupal: The AI inflection point The vulnerable code had been present for more than a decade. Turning these flaws into working exploits required chaining multiple bugs and accounting for how PHP allocates and reuses memory across requests. Memory bugs are notoriously complex; differences in PHP versions, configurations and application behavior can break assumptions the exploit depends on. An attack that works against one deployment may need substantial adjustments to work against another, each requiring further analysis, testing and debugging. Pre-AI, this manual work would be difficult to implement and even harder to scale. With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts. With testing and debugging tools, models can analyze failures and iterate on adjustments, reducing the specialist effort required for each target. This significantly lowers the barrier to scaling attacks across different deployments. This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets. We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch. Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex. We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them. Raluca Ada Popa, Head of Gemini Security, Google DeepMind Industry-level collaborations Prior to public disclosure, Wiz Research worked with the PHP team, Calif and OpenAI on discovery, coordination and patch verification. We also partnered with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and many others to prepare customer guidance, detections and out-of-the-box mitigations for organizations that cannot update immediately. A vulnerability in core PHP reaches far beyond a single application. PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem. Technical deep dive Bug: Upload-progress unserializer use-after-free PHP's Session module can decode session data during upload-progress handling in the same pre-initialization window. The decoder stores request-owned bookkeeping in BG(unserialize). A fatal allocation failure can interrupt this path, destroy the request heap and leave the unserializer's global state published. On a later request handled by the same worker, PHP can consume attacker-reclaimed memory as live unserializer bookkeeping. The stale state becomes a powerful memory-corruption primitive. We combined it with the memory disclosure to remove address uncertainty and achieved unauthenticated remote code execution on WordPress, Drupal and Joomla. The WordPress, Drupal and Joomla chains are representative demonstrations. The underlying primitives exist at the PHP engine level and can affect any PHP application running on a vulnerable version. These issues execute below the application layer, so application logs may contain little context. Until systems are patched, defenders should pay particular attention to unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn. These signals can guide an investigation. Applying the PHP security update remains the only complete remediation. Bug: Remote process-memory disclosure PHP parses RFC1867 multipart requests during request startup, before normal module initialization has completed. Session upload-progress handling can initialize Session state at this early stage and publish a session ID in PS(id). An out-of-memory error can abort the request before cleanup completes. PHP then destroys the request heap and may leave PS(id) pointing to the freed allocation. A later multipart request handled by the same worker can reach the upload-progress cleanup path before normal Session initialization resets that pointer. PHP trusts the stale pointer and length as a live zend_string and URL-encodes the reclaimed heap contents into a PHPSESSID response cookie. The attack works even when the application never calls session_start(), making the issue application-agnostic. We demonstrated unauthenticated disclosure of an attacker-sized region of live worker memory containing data from outside the attacker's request. Bug: Fatal-error backtrace use-after-free In affected versions, PHP retains the backtrace of the most recent fatal error in EG(last_fatal_error_backtrace). A fatal out-of-memory error can destroy the request heap without undefining that executor-global value. The worker survives with a global that still points to memory from the previous request. If the same worker emits a diagnostic early in the next request, it can access the pointer before the executor reinitializes that state. PHP then destroys or updates the dangling backtrace and follows attacker-reclaimed memory. The resulting cross-request use-after-free can be developed into controlled memory corruption. We demonstrated unauthenticated remote code execution against Drupal using this primitive. Bug: OPcache type confusion OPcache persists compiled PHP structures in shared memory and assigns indices into per-worker runtime-pointer maps. Workers coordinate those indices through a shared frontier. During zend_accel_script_persist(), PHP advances the process-local CG(map_ptr_last) frontier. It publishes the corresponding shared frontier only after persistence completes. An allocation failure between those two events leaves the process-local advance in place and partially persisted objects referring to slots that the shared state still considers available. When another worker later reuses one of those slots for a different runtime object, stale shared metadata resolves to a pointer of the wrong type. The mismatch creates a cross-worker type confusion and corrupts shared OPcache state. We used this primitive to build an unauthenticated RCE chain against WordPress. There are other variants outside of these four bugs. While we initially reported these four to PHP, through this research we realized the vulnerability is deeply rooted in the PHP codebase and will require a comprehensive fix. Other variants should also fold under the same two CVEs. Conclusion With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated. It marks an AI inflection point. The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit. With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work. This changes the economics of both discovery and exploitation. Vulnerabilities that once seemed impractical to exploit become viable targets. These same capabilities also give defenders a chance to uncover and fix flaws that have survived years of scrutiny. Wiz used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol throughout this research, with Argon making a particularly significant contribution to finding and helping to remediate the vulnerability. The opportunity is to make this work routine: systematically finding flaws in existing software and catching new ones before they reach production. Our coordinated efforts with PHP, OpenAI and Calif advance that goal, applying AI to strengthen the software foundations we all share. Responsible disclosure timeline August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. August 20, 2026: Unauthenticated RCE is confirmed against Drupal. August 21, 2026: Unauthenticated RCE is confirmed against WordPress. August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team. September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix. October 21, 2026: Patched PHP releases become available. October 21, 2026: Public disclosure. Stay in touch Hi there! We are Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz from the Wiz Research Team (@wiz_io). We are a group of veteran white-hat hackers with a single goal: to make the cloud a safer place for everyone. We focus on finding new attack vectors in cloud software and uncovering isolation issues in the systems organizations depend on. We would love to hear from you on X or at [email protected]. Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets. How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published Get a personalized demo Ready to see Wiz in action? "Best User Experience I have ever seen, provides full visibility to cloud workloads." David EstlickCISO "Wiz provides a single pane of glass to see what is going on in our cloud environments." Adam FletcherChief Security Officer "We know that if Wiz identifies something as critical, it actually is." Greg PoniatowskiHead of Threat and Vulnerability Management