Wiz Research combined two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, into a single exploit script called php2shell, demonstrating unauthenticated remote code execution against current container images of WordPress, Drupal and Joomla.

The flaws are memory-safety issues in PHP's core engine — how it handles fatal errors and out-of-memory conditions — leaving stale or corrupted internal state that later requests can reuse.

Wiz says every PHP version released in the last decade, going back to 5.4, is affected by at least one of the bugs, which carry a CVSS score of 9.2 per Forkast News.

The surprising core of this story is that the vulnerable code existed for years, but proving exploitability required chaining multiple bugs and adapting to each target's memory layout — work Wiz describes as at the edge of what human researchers could practically achieve.

Frontier AI models substantially reduced that barrier. According to CNN, a single researcher completed in a week what would previously have taken a world-class team months.

Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and Google DeepMind's Raluca Ada Popa credited Gemini 4 Argon with contributions to discovery, exploit development, detection and patch validation.

Beyond code execution, Wiz demonstrated that attackers could read sensitive data from the PHP process's memory without achieving remote code execution, potentially exposing passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.

Because the flaws execute below the application layer, even a simple 'Hello World' PHP app on an affected version is vulnerable, and application logs may contain little context.

Wiz points defenders toward unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, malformed PHPSESSID cookies and unexplained PHP worker churn as investigation signals.

The response escalated to official advisories on both sides of the Atlantic.

The NSA urged organizations to inventory internet-facing services reliant on PHP, prioritize vendor patches tied to PHP2Shell, add enhanced logging, replace end-of-life PHP services that cannot be patched, and take systems offline if immediate mitigation is not feasible.

The UK's NCSC identified the same two CVEs and advised identifying all PHP installations — not just outdated versions — updating to the latest fixed release, applying the PHP Foundation's temporary mitigations where patching is not possible, and checking for evidence of compromise before upgrading.

PHP released patches on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with only minimal source-backports for end-of-life branches 7.4, 8.0 and 8.1, per Forkast News.

Endor Labs notes that updating a CMS or its plugins does not fix a vulnerable PHP runtime — the fix must reach the runtime itself, which may arrive through a base image or hosting provider and require rebuilding containers.

Apache mod_php deployments are flagged as the highest-risk surface because the attack can trigger before any application code runs. As a stopgap, Forkast reports the PHP project recommends setting memory_limit to -1 and disabling session upload progress and fatal error backtraces.

Wiz researchers compare PHP2Shell to Heartbleed in 2014 and Log4Shell in 2021 — turning points where shared infrastructure failures revealed systemic exposure, and in this case a moment that shows AI changing what counts as practically exploitable.

CNN reported that several government and company websites worldwide went dark briefly on Wednesday as operators updated, with some European government sites taken offline, according to Reuters.

The disclosure was a coordinated cross-industry effort: Wiz worked with the PHP team, Calif and OpenAI, while Cloudflare, AWS, Google, Microsoft, Akamai and others deployed detections and out-of-the-box mitigations ahead of public disclosure.

Cloudflare reports attackers are already mutating payloads to evade its WAF rules, making runtime patching the only complete fix.