PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting Core PHP

ArticleWiz ResearchNews

Wiz Research has disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine affecting versions dating back to PHP 5.4. Tracked under CVE-2026-109618 and CVE-2026-109619 with CVSS scores up to 9.2, they enable unauthenticated remote code execution and process-memory leakage. Researchers utilised frontier AI models to rapidly build and adapt complex exploit chains across targets.

Key points

  1. Nearly every PHP release over the last decade (back to 5.4) is affected, existing entirely at the runtime engine level independent of application-level security.
  2. Grouped under CVE-2026-109618 and CVE-2026-109619, the flaws involve use-after-free and type confusion triggered when handling fatal errors like out-of-memory events.
  3. Attackers can achieve pre-authentication RCE (demonstrated on default container images of WordPress, Drupal, and Joomla) or disclose live worker memory via crafted requests.
  4. Frontier AI models, including Gemini 4 Argon and GPT-5.6 Sol, were instrumental in finding the flaws, validating patches, and iteratively tailoring exploits across memory layouts.
  5. PHP released security patches addressing the root engine flaws on 21 October 2026, and immediate updates are strongly urged.

Why it matters

PHP underpins approximately 70% of the world's websites. Because the flaw resides below the application layer, even completely hardened CMS code remains vulnerable. Crucially, the discovery highlights an inflection point: frontier AI removes the traditional manual friction of debugging and scaling intricate memory-corruption exploits across diverse hosting environments.

Analysis

PHP2Shell fundamentally alters the defensive calculus around legacy memory bugs. While the vulnerable routines existed quietly for over a decade, translating them into reliable cross-platform exploits previously required deep, manual reverse engineering and debugging. By leveraging LLMs to iterate on memory layouts and failure states in hours, complexity no longer serves as an effective barrier to exploitation. Operators unable to patch immediately must monitor for multipart request spikes, memory-limit exceptions, abnormal HTTP 500 rates, and malformed PHPSESSID cookies.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Link:Calif Research

    PHP2Shell: Critical Remote Code Execution Flaws Uncovered in PHP

    Calif Research has disclosed PHP2Shell, detailing two severe PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) triggered via out-of-memory states and addressed in the October 2026 security release.

    Web development· Research

  • Link:watchTowr

    PHP2Shell: Exploited Remote Code Execution Vulnerabilities in PHP

    Dubbed PHP2Shell, two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP allow unauthenticated attackers to execute arbitrary code. Security firm watchTowr confirmed in-the-wild exploitation.

    Web development· Resource

  • Article:Daniele Molteni, Dan Jones, and Kuber Nandwani

    Cloudflare Deploys Protections Against php2shell Vulnerabilities

    Cloudflare has rolled out Managed WAF rules to protect against the php2shell vulnerabilities affecting PHP 5.4 and later. The mitigations introduce full transaction detection to block exploits before responses reach requesters.

    Web development· News

  • Article:Etiido Uko

    Linux Kernel Approaches 2,000 CVEs per Release Amid AI Bug-Hunting Influx

    The growing use of AI tools for static code analysis is pushing the number of CVE fixes in the Linux kernel to unprecedented levels. Maintainers are struggling under a flood of submissions ranging from verified vulnerabilities to hallucinations and trivial clean-ups, prompting the removal of legacy drivers and the deployment of AI-based patch filtering.

    AI & LLMs· News

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.