PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Two flaws in PHP’s core engine prompted emergency fixes and temporary website shutdowns as operators assessed exposure.
TL;DR
- Wiz disclosed two critical vulnerabilities in PHP core that can expose affected servers to remote code execution or process-memory disclosure.
- The PHP project released fixes on October 21, and U.S. and European organizations temporarily took some sites offline while applying updates.
- OpenAI said AI-assisted research helped identify vulnerabilities, while the exact extent of exploitation and patching across deployed systems remains unclear.
Wiz Research disclosed two vulnerabilities grouped under the name PHP2Shell in PHP’s core engine. The company said one flaw enables unauthenticated remote code execution and another can expose process memory; it reported affected PHP releases reaching back to version 5.4. [1]
The PHP project issued fixes on October 21 for the memory-safety issues. The PHP Foundation’s advisory and Wiz’s account describe the fixes as covering releases across maintained PHP branches, while the vulnerabilities were tracked as CVE-2026-109618 and CVE-2026-109619. [1] [2]
The Associated Press reported that the FBI’s cyber division warned the flaws could permit remote code execution and that some U.S. and European organizations temporarily took websites offline while they applied updates. It reported that the Finnish government’s website was partly unavailable during remediation. [3]
OpenAI said it coordinated work with maintainers, researchers and security providers, and that AI systems helped researchers find the vulnerabilities. Axios also reported Cloudflare chief executive Matthew Prince’s account of rising exploit attempts around public disclosure; the available reports do not establish how many attacks succeeded or how many exposed installations remain unpatched. [3] [4]
Why it matters
The case connects AI research capability to internet infrastructure security: tools that can expose long-standing weaknesses may accelerate defensive discovery, while public disclosure creates pressure on operators to identify and update widely deployed software. The cited reports do not quantify remaining exposure.
Editor's note
Added in the 19:00 KST same-date merge. Technical severity and scope are attributed to Wiz and reporting; successful exploitation at scale is not established in the cited sources.