Loading page…
Researchers demonstrated attacks without a login on WordPress, Drupal and Joomla deployments. PHP’s widespread use signals scale, not a count of vulnerable websites.
Listen to this story
The flaws stem from PHP’s handling of fatal errors and memory exhaustion, not from bugs in individual websites: Wiz demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla, as well as access to sensitive process memory. The four bugs date back to PHP 5.4, fall under CVE-2026-109618 and CVE-2026-109619, and reached a CVSS severity score of 9.2; PHP released a patch on October 21, 2026, which Wiz calls the only complete remediation. Wiz says AI models helped make exploit development across different deployments practical in hours, making patching affected PHP versions the key defensive priority.
Memory disclosure could expose passwords, tokens and API keys even when attackers do not achieve code execution.
The Wall Street Journal cites PHP on up to 70% of websites, but that figure is not an estimate of exploitable deployments.
Wiz recommends patching; interim warning signs include malformed multipart requests, oversized PHPSESSID cookies, memory-limit errors, repeated HTTP 500s and PHP worker churn.
AI helped researchers turn longstanding PHP bugs into working server-takeover attacks—and helped them prepare a fix. PHP disclosed critical vulnerabilities on October 21, 2026, and released a patch, according to Wiz Research. The immediate stakes extend beyond finding bad code: Wiz says AI substantially reduced the work needed to make those flaws exploitable across different applications.
Wiz’s PHP2Shell disclosure describes four exploitable bugs grouped under CVE-2026-109618 and CVE-2026-109619, with severity reaching 9.2 on the CVSS vulnerability-rating scale. Researchers demonstrated remote code execution—running an attacker’s instructions on a server—without logging in, using WordPress, Drupal and Joomla deployments.
Wiz also demonstrated reading sensitive server-process memory without achieving code execution, potentially exposing passwords, tokens and API keys. The underlying bugs concern fatal errors, particularly when memory runs out. A request can end while leaving corrupted internal state that later requests or workers reuse, allowing memory disclosure or corruption.
Wiz says affected versions date back to PHP 5.4. The Wall Street Journal puts PHP’s reach at as much as 70% of websites. That usage estimate is not a count of exploitable sites: requirements differ across the bugs and deployments.
The vulnerable code had existed for more than a decade, according to Wiz. Exploiting it required linking bugs and adapting to how different deployments allocate and reuse memory. Models helped analyze failures and revise attacks through testing and debugging.
Wiz says frontier models made that process practical, helping the team develop and adapt working exploits across multiple applications in hours. It names Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol as research tools, crediting Gemini with contributions from discovery through patch validation.
The Journal credits security company Calif with discovering the issue using AI tools. Wiz says it worked with Calif, OpenAI and the PHP team on discovery, coordination and patch verification.
Before disclosure, Wiz worked with companies including AWS, Cloudflare, Microsoft and Automattic on guidance, detection and mitigations. It identifies the PHP update as the only complete remediation, addressing the underlying failure pattern and its variants.
Application logs may offer little context because the attacks operate below that layer. Until patching is complete, Wiz recommends investigating these signals:
Story updates
AI-assisted discovery gave defenders a head start on critical PHP flaws, OpenAI says. Turning that lead into protection took two months of coordination. On October 21, the company detailed that response and proposed a framework for future discoveries, alongside a $1 billion commitment in subsidized Daybreak access for resource-limited organizations protecting essential services.
The company’s Patch the Planet initiative supported a response led by PHP’s maintainers, who handled the fixes and release. OpenAI, Wiz, Cloudflare and other partners contributed research, technical support and preparations for disclosure. PHP is an open-source programming language used to run websites and web applications.
OpenAI credits Calif with identifying one critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. The company says that, to its knowledge, frontier AI found the flaws before attackers did. That is its assessment of the discovery timeline, not a guarantee that attackers never knew about them.
PHP’s own security advisory illustrates the stakes. One flaw lets an out-of-memory error leave request memory in an invalid state. Researchers validated remote code execution—running an attacker’s instructions on a server—without a login against Apache’s mod_php configuration. Exploit reliability depends on the PHP build, extensions and server setup.
For that vulnerability, the advisory lists patched releases as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It says updating to a release containing the patch is the only complete mitigation. OpenAI has shared a PHP version checker and plans an accompanying Codex skill to help operators identify potentially vulnerable versions and determine applicable updates.
Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable.
The proposed framework is not a requirement to assemble a global coalition for every bug. OpenAI says some findings can be handled directly between researchers and maintainers. Others need a wider response because they affect many products, or because distributors and providers need time to prepare protections. It describes five stages:
Validate the flaw and test a fix, including using frontier models to look for ways around the patch.
Give affected organizations advance information so they can adapt fixes, test mitigations or prepare detection measures.
Coordinate with government partners to help guidance reach critical infrastructure and other essential services.
Bring in additional distributors, providers and operators as fixes and disclosure plans stabilize.
Publish guidance once a patch is available, then support deployment and checks that the fix is running.
Maintainers would decide whom to involve before disclosure. The criteria include an organization’s protective role, the time it needs to act and its ability to handle sensitive information. Participants would receive only what their protective work requires. The timeline would be reassessed if exploitation, leaks, a revealing public patch or stalled repairs increased users’ risk.
OpenAI says small maintainer teams need help sorting duplicate reports, assessing impact and testing repairs across supported releases. Its support includes funding, model access and engineering help; open-source projects can apply to Patch the Planet for hands-on assistance. The $1 billion commitment is specifically subsidized Daybreak access through Daybreak for Frontline Defenders.
The framework remains a proposal. OpenAI is asking the security community how long disclosure windows should last, who needs early notice, and when broader notification is worth the leak risk. It also wants independent security experts to challenge the approach and identify gaps.
github.comLoading discussion...
Join the conversation
Explain whether limiting misuse would justify limiting access for independent defenders.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.