PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research discovered critical remote code execution and memory disclosure vulnerabilities in PHP's core engine that affect every version released in the past decade, potentially compromising 70% of websites worldwide. The vulnerabilities, which had remained hidden for over a decade, were uncovered using frontier AI models that significantly reduced the complexity barrier needed to demonstrate exploitability. PHP released patches on October 21, 2026, addressing these severe flaws that could allow attackers to steal sensitive data and take control of affected servers.