PHP2Shell: AI uncovers critical RCE in PHP
What happened
Wiz Research discovered critical remote code execution and memory disclosure flaws in the core PHP engine, affecting roughly 70% of websites. The vulnerabilities, present in every PHP version released since 5.4, allow unauthenticated attackers to run code on servers or read sensitive memory containing passwords and keys. Frontier AI models helped chain multiple flaws into a working exploit, turning a decades‑old issue into a practical attack. PHP released a patch on October 21, 2026 to fix the memory‑safety problems. The findings are grouped under two CVEs with a CVSS score of 9.2, marking a severe security event.
Why it matters
If exploited, these bugs could let attackers take over websites or steal confidential data, directly impacting the security of many online services that rely on PHP. Ordinary users may see compromised sites, data breaches, or defaced pages as a result.
Reality check
An automated, sceptical read of the sourceNotable. The vulnerabilities are severe and widespread, but the core issue existed for years and was only made exploitable by AI assistance, making the news significant yet not a brand‑new type of flaw.
Is this a big deal?
Get stories like this every morning
The day's AI news in plain English, in your inbox at 8:30 IST. Free.
More AI news
AI unlocks Gödel's notebooks, said to contain hundreds of proved theoremsIndustry news · 13 Nov 2026Gemini 4 Hydrogen and OrchestratorIndustry news · 12 Nov 2026Gemini 4 HydrogenIndustry news · 12 Nov 2026I'm making LLMs work on small and old devicesIndustry news · 12 Nov 2026United Airlines bans AI agents from booking flights on behalf of travelersIndustry news · 11 Nov 2026This page was collected from wiz.io and summarised automatically by AIPulsee's pipeline. See how it runs.