PHP (PHP: Hypertext Preprocessor) powers a large share of the internet, as it runs websites, content management systems, and other online services that millions of people use daily. As such, its widespread use means that a security flaw in the language itself can put websites at risk, even when their individual applications have no known security weaknesses.
This concern has come into focus following the discovery of two critical PHP vulnerabilities known as PHP2Shell.
Disclosed on Wednesday, the flaws could allow attackers to execute malicious code on vulnerable servers without authentication.
Security researchers at Wiz identified the weaknesses with the help of artificial intelligence (AI), exposing risks that had remained in PHP’s core infrastructure for years.
How PHP2Shell Exposes Websites to Attacks
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP’s internal memory management and request-handling processes, with both receiving a critical severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system.
According to Wiz Research, the flaws can allow attackers to manipulate a PHP server’s memory and execute commands remotely. Researchers demonstrated successful attacks against websites running WordPress, Drupal, and Joomla without requiring a login or exploiting a separate vulnerability in those platforms.
Wiz also estimates that the language powers approximately 70% of websites worldwide, which means the vulnerabilities could affect a broad range of online services running vulnerable versions.
The first flaw, CVE-2026-109618, involves memory corruption when PHP encounters an out-of-memory error during request processing. The second, CVE-2026-109619, involves references to memory that has already been released. These weaknesses can leave PHP processes in an unsafe state, allowing subsequent requests to trigger further memory corruption or expose sensitive information.
AI Helped Researchers Turn Old Bugs Into Working Exploits
The discovery also demonstrates how AI is changing cybersecurity research. According to Wiz, the underlying weaknesses had existed for more than a decade, but developing reliable exploits required researchers to connect multiple bugs and account for how PHP handles memory across requests.
AI models helped researchers investigate these complex interactions and develop working exploits. “Wiz Research worked with the PHP team, Calif and OpenAI on discovery, coordination and patch verification,” the company said.
The researchers also demonstrated that the flaws could expose sensitive information stored in PHP process memory, including passwords, authentication tokens, and API keys. And this immediately creates an additional risk for organizations whose applications handle confidential information.
PHP Releases Security Fixes as Exploitation Attempts Emerge
The PHP project released security updates on October 21, addressing both vulnerabilities in supported release branches. Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations running older versions are advised to consult the official security advisory and their software vendors for available fixes or upgrade options.
The disclosure has also been followed by reports of attempts to exploit the PHP2Shell vulnerabilities. Amazon Threat Intelligence reported detecting an exploit attempt on October 17, targeting an Amazon honeypot, a system designed to attract and study malicious activity. The company later detected further exploitation attempts on October 21, but said it was unclear whether the earlier attempts would have succeeded against real-world systems.
These vulnerabilities highlight the security risks that can emerge when weaknesses remain hidden in widely used software for years.
