PHP2Shell: AI uncovers critical RCE in PHP
Wiz Research has identified critical remote code execution vulnerabilities in the core PHP language, affecting versions released over the last decade. The discovery was accelerated by the use of frontier AI models, which helped researchers navigate complex code paths.
Why it matters
PHP powers a vast majority of the web; these vulnerabilities pose a massive security risk to global internet infrastructure.
Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.
PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.
These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it , putting every affected website in immediate risk.
Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.
On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine.
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in