PHP powers roughly 70% of the world’s websites, according to Wiz Research, so a flaw in its core engine affects much more than any single application. On Wednesday, researchers disclosed two critical vulnerabilities discovered with help from frontier AI models. OpenAI also proposed a new framework for handling the growing number of security flaws AI is helping uncover.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, score 9.2 on the CVSS v4.0 severity scale. Researchers at Calif.io found one using OpenAI’s GPT-5.6 Sol, while Wiz independently found both using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and GPT-5.6 Sol. Cloudflare also lists Quarkslab among the parties that disclosed the bugs.
The problem starts with how PHP handles errors. When a request runs out of memory or crashes, PHP can leave behind references to memory that has already been freed. The next request handled by the same worker process may still treat those references as valid. Wiz found that attackers could exploit this behavior to access sensitive data or run malicious code.
These are memory-safety bugs, including use-after-free and type confusion, that developers have spent years trying to prevent by moving critical C code to languages like Rust. PHP’s engine is written in C, and Wiz showed that attackers could exploit the flaws to run code on WordPress, Drupal, and Joomla without logging in. Researchers also demonstrated attacks that exposed server memory without executing code.
4. The bugs went unnoticed for so long because exploiting them required combining several weaknesses in ways that were difficult to uncover.
Source link
