Article:Wiz Research
PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting Core PHP
Wiz Research has disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the core PHP engine affecting versions dating back to PHP 5.4. Tracked under CVE-2026-109618 and CVE-2026-109619 with CVSS scores up to 9.2, they enable unauthenticated remote code execution and process-memory leakage. Researchers utilised frontier AI models to rapidly build and adapt complex exploit chains across targets.
From Video: PHP2Shell: Kritische Sicherheitslücken im PHP-Interpreter ermöglichen RCE
