PHP2Shell: AI Found the Bug Humans Missed for Ten Years

CVE-2026-109618. CVSS 9.2. The bug had been sitting inside PHP’s core engine since version 5.4, over ten years, in a language that still runs something like 70% of the web. Not a plugin. Not a theme. Not a line of application code anyone wrote. The engine itself.

Wiz Research calls the chain PHP2Shell. Four separate flaws, stacked: a use-after-free in the upload-progress unserializer, a way to leak raw process memory (passwords, tokens, API keys, sitting right there in worker RAM), a second use-after-free triggered by fatal-error backtraces, and an OPcache type-confusion bug that corrupts shared memory between workers. Chained together, they produce unauthenticated remote code execution. Wiz demonstrated it against current WordPress, Drupal and Joomla installs, not toy environments built to make the demo easy.

Separate from the RCE chain, the process-memory disclosure bug is its own problem and arguably the quieter one. PHP-FPM workers hold passwords, session tokens and API keys in memory while they process requests. Reading that memory doesn’t require full code execution, only triggering the fatal-allocation path that exposes it. If your hosts ran any version between PHP 5.4 and whatever you had installed before October 21, treat any secret that passed through those workers as potentially exposed and rotate it. Don’t assume the patch alone closes that door after the fact.

What makes this case different from the usual CVE churn is how it was found. Wiz’s team worked with Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, running them against PHP’s source in parallel. Finding and chaining four separate memory-safety bugs in code this old is normally the kind of work that eats a strong security team’s calendar for months. Wiz says the models got them there in about a week.

Nine weeks, start to patch

August 19: the anomaly gets flagged. August 20 and 21: Wiz confirms working remote code execution against the three biggest CMS platforms on the internet. August 24: PHP’s own security team gets the report. A month of quiet work follows while the fix gets built, because four interconnected memory bugs don’t patch cleanly and PHP’s maintainers had to avoid shipping a fix that broke under real production load. Public disclosure and the actual security release landed October 21, nine weeks after the first flag.

The part that matters more than “AI found it”

Every outlet covering PHP2Shell led with the AI angle because it’s the easy headline. The more useful fact sits further down in Wiz’s own writeup: this bug lived in PHP’s core for a decade, through however many internal and third-party audits a language running roughly seven in ten websites has accumulated, and nobody caught it. Human review missed it for ten years. A model stack found it in a week. That ratio should bother anyone who still treats “we did a security review once” as a durable control.

The dual-use problem nobody wants to sit with

Compress audit time from months to a week and you compress it for both sides. Wiz, Calif and OpenAI handled this one through responsible disclosure, reporting to the PHP team instead of selling or exploiting it. Nothing about the tooling they used requires that choice. The same model stack pointed at the same PHP source, run by someone with no interest in filing a CVE, finds the same chain on roughly the same timeline. The nine weeks between discovery and patch was the entire window the ecosystem had to prepare before this went public, and that window was set by how fast PHP’s maintainers could safely ship a fix, not by how fast anyone else could independently stumble onto the same bugs.

What to actually do this week

Check your PHP version across every host serving traffic, not just the ones you remember exist. This is a core-engine bug, so a web application firewall sitting in front of a vulnerable PHP install does not fix it. Wiz says plainly that applying the security update is the only complete remediation. If you run WordPress, Drupal, Joomla or anything else on PHP and haven’t confirmed the October 21 patch landed, that outranks everything else on your list today. Container images built before that date need rebuilding, not just the running hosts restarting.

One more thing worth checking: Wiz’s working exploit existed from August 20, a full two months before public disclosure, inside a researcher’s lab rather than in the wild. There’s no public evidence of in-the-wild exploitation before the patch, and Wiz’s own disclosure doesn’t claim otherwise. Still, if your logging goes back that far, a pass through PHP-FPM and web server logs for the August-to-October window is cheap insurance, especially on anything internet-facing that was slow to patch.

PHP has carried this bug since around 2012, through every security audit anyone bothered to pay for. It took three AI models about a week to find it. Decide for yourself what that says about the audits.

Sources

Wiz Research: PHP2Shell (primary technical disclosure, retrieved October 26, 2026).