PHP2Shell: two unauthenticated RCEs in PHP core found with the help of AI models
In one sentence On October 21 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), engine memory-safety flaws allowing unauthenticated remote code execution. Wiz found them using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas.
PHP is the language behind a huge share of the web, from WordPress to Drupal and Joomla. On October 21 PHP developers published urgent updates for two flaws in the core of the language, not in a specific application: that is why even a very simple PHP site can be vulnerable if it runs an unpatched version.
The flaws let an attacker, without credentials, run code on the server or read its memory, which may contain passwords, tokens and keys. According to Wiz practically every version of the last decade, back to PHP 5.4, has at least one of the issues.
What is new is how they were found: Wiz researchers used AI models (Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol) to discover the bugs, build exploits, adapt them to different versions and validate the fixes. The same tool that speeds up defense also speeds up attack, and the race to patch started immediately.
Companies
Wiz, PHP, OpenAI, Google
Tools
Gemini 4 Argon, GPT-5.6 Sol, Wiz Atlas
Tags
Sources
- https://www.wiz.io/blog/php2shell-php-rce
- https://cert.europa.eu/publications/security-advisories/2026-018/
- https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619