Wiz Research, in collaboration with Calif and OpenAI, recently identified a family of critical memory-safety vulnerabilities in the core PHP engine. These flaws, collectively referred to as PHP2Shell, allow unauthenticated attackers to execute remote code or disclose sensitive process memory, such as passwords and API keys. Because PHP powers approximately 70% of the world's websites—including major platforms like WordPress, Drupal, and MediaWiki—the discovery poses a significant risk to a massive portion of the internet's infrastructure. The vulnerabilities are independent of the specific applications running on top of PHP, meaning even a secure 'Hello World' application could be compromised if it runs on an affected PHP version.
The research identifies a family of critical memory-safety vulnerabilities in the core PHP engine.
The technical root of these issues lies in how PHP handles fatal errors, particularly out-of-memory (OOM) events. When a request triggers an OOM error, the PHP engine may leave behind a corrupted internal state or 'stale' global pointers. Subsequent requests handled by the same worker process can then reuse this corrupted state. Specifically, the research identified four exploitable bugs grouped under two CVEs (CVE-2026-109618 and CVE-2026-109619). These include an 'upload-progress unserializer use-after-free' and an 'OPcache type confusion.' In the latter, an allocation failure during script persistence causes a mismatch in shared memory indices, leading to cross-worker type confusion that can be leveraged for remote code execution.
Because PHP powers approximately 70% of the world's websites—including major platforms like WordPress, Drupal, and MediaWiki—the discovery poses a significant risk to a massive portion of the internet's infrastructure.
A key finding of this research is the role of frontier AI in bridging the gap between theoretical flaws and practical exploits. While these vulnerabilities had existed in the PHP codebase for over a decade, the complexity of chaining multiple memory bugs and adapting them to different server configurations made them difficult for human researchers to exploit at scale. The research team utilized models like Gemini 4 Argon and GPT-5.6 Sol to automate the testing, debugging, and adaptation of exploits across different environments. This shift in capability suggests that complexity may no longer serve as a sufficient barrier to exploitation, as AI can rapidly iterate on the intricate steps required to navigate memory layouts and configuration nuances. PHP has since released patches to address these core engine flaws, and immediate updates are recommended for all affected systems.