PHP2Shell: AI Unlocks Critical RCE in the PHP Core

PHP2Shell represents a seismic shift in vulnerability research, where AI was used to uncover critical Remote Code Execution (RCE) flaws impacting approximately 70% of the global internet. These vulnerabilities in the core PHP engine allow for both memory disclosure (reminiscent of Heartbleed) and full system takeover.

---

🛡️ Executive Summary

Wiz Research has identified several catastrophic vulnerabilities within the core of PHP, the ubiquitous scripting language that serves as the foundation for platforms like WordPress, Drupal, Joomla, and Wikipedia's MediaWiki.

The Bottom Line: Because these flaws exist in the PHP engine itself, they are independent of the application code. If the server runs a vulnerable version of PHP, the site is at risk regardless of how secure the website's own code is.

Key Facts at a Glance:

• Scope: Every PHP version released in the last decade (dating back to v5.4) is affected by at least one flaw.
• Impact: Unauthenticated attackers can execute arbitrary code or leak sensitive process memory.
• Severity: Reaching a CVSS score of 9.2.
• Resolution: Patches were released by the PHP team on October 21, 2026.

---

🤖 The AI Catalyst: Redefining "Exploitability"

For years, these bugs existed in the codebase, but they remained dormant because the path to exploitation was too convoluted for human researchers to practically navigate. The process required a precise chain of memory manipulations and constant debugging against specific memory layouts.

Complexity equals security. $\rightarrow$ AI has invalidated this assumption.

Frontier AI models acted as a force multiplier, reducing the time required to develop and adapt working exploits from weeks of manual labor to just a few hours.

The Exploit Evolution

This discovery suggests that we are entering a new era where the practical exploitability of "complex" bugs is increasing rapidly due to AI.

---

🔍 Technical Deep Dive

The vulnerabilities are rooted in memory-safety issues. Specifically, they trigger when PHP handles fatal errors (such as out-of-memory errors) during request processing.

The Mechanism of Failure

1. A request triggers a fatal error.
2. The PHP engine fails to clean up properly, leaving a corrupted internal state.
3. A subsequent request or worker process reuses this stale state.
4. This leads to a use-after-free scenario, allowing for memory corruption or disclosure.

Vulnerability Mapping

Note: While the researchers demonstrated RCE on popular CMSs, the flaw is application-agnostic; it resides in the PHP engine itself.

---

🌐 A Turning Point for Web Security

Wiz Research views PHP2Shell as a landmark event, similar to previous industry-shifting vulnerabilities:

• 2014 (Heartbleed): Highlighted the fragility of the internet's shared encryption infrastructure.
• 2021 (Log4Shell): Showed the danger of deeply embedded software dependencies.
• 2026 (PHP2Shell): Demonstrates how AI transforms theoretical vulnerabilities into practical weapons.

The mathematical risk can be viewed as: $\text{Risk} = \text{Vulnerability} \times \text{AI-Accelerated Exploitability}$

---

🤝 Coordination and Gratitude

This was a massive cross-industry effort to ensure the web remained stable during disclosure.

Key Partners:

• Discovery & Patching: The PHP team, Calif, and OpenAI.
• Mitigation Support: A coalition including AWS, Google, Microsoft, Cloudflare, Akamai, Fastly, Vercel, Imperva, and Automattic.

Immediate Action Items for Admins:

• Identify all servers running PHP (especially versions $\ge$ 5.4).
• Apply the October 21, 2026, security patches immediately.
• If patching is impossible, deploy provided out-of-the-box mitigations from cloud providers.

---

🖼️ Visual Evidence

Below are the assets and research snapshots associated with the discovery: