Summary
Wiz Research says it found four exploitable memory-safety bugs grouped under two PHP CVEs, including flaws that enabled unauthenticated remote code execution in demonstrations. The PHP project released patches on October 21, 2026.
Wiz Research reported four exploitable memory-safety bugs in PHP, grouped under CVE-2026-109618 and CVE-2026-109619. The company demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla deployments; the PHP project released patched versions on October 21, 2026.
The flaws are in PHP’s core engine rather than in those applications. Wiz says the bugs can also expose data held in a PHP worker’s memory, including passwords, authentication tokens and API keys. It describes the reported issues as reaching a maximum severity of CVSS 9.2.
How the PHP flaws could be exploited
The bugs arise when PHP handles fatal errors, particularly out-of-memory errors, during a request. In some cases, the interrupted request leaves behind internal state that still points to memory that has already been freed. If a later request is handled by the same worker—or, for one issue, another worker using shared OPcache state—PHP can treat that stale information as valid.
That creates opportunities for memory disclosure or corruption. Wiz combined several of the issues into an exploit it calls php2shell. Its demonstrations achieved pre-authentication remote code execution on WordPress, Drupal and Joomla container images described as the latest available at the time of testing. The applications were examples: according to Wiz, exploitation does not depend on a vulnerability in their own code, and even a simple PHP application may be affected.
The four reported bug instances include an upload-progress use-after-free, a fatal-error backtrace use-after-free and an OPcache type-confusion issue, alongside a process-memory disclosure. A use-after-free occurs when software continues to use a pointer to memory that has already been released. In these cases, later activity could make the stale state useful to an attacker. The memory-disclosure path could expose data from outside the attacker’s own request without first achieving code execution.
Wiz says every PHP version released over the previous decade, going back to PHP 5.4, is affected by at least one of the vulnerabilities. It also says PHP’s patch addresses the underlying issue and variants of the same pattern. The company advises administrators to install the PHP security update.
AI’s role in finding and adapting the exploit
Wiz says the vulnerable code had been present for more than a decade, but turning the flaws into working exploits required chaining bugs and adapting to differences in PHP versions, configurations and memory layouts. The researchers used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol during the work. Wiz credits Gemini 4 Argon with a significant contribution to finding the vulnerability, developing the exploit, detecting attacks and validating the patch.
The practical change, in Wiz’s account, was that AI models and testing tools helped researchers analyse failed attempts and adjust the exploit more quickly across different deployments. That can lower the specialist effort needed to make a complex memory bug exploitable. The same capability can also help defenders find and fix vulnerabilities that have resisted earlier analysis.
Wiz coordinated disclosure with the PHP team and other organisations, which prepared customer guidance, detections and mitigations for systems that could not be updated immediately. The company’s central remediation recommendation is to apply the PHP security update.