Wiz finds critical PHP flaws that AI helped turn into remote code execution
AIWiz Research reports multiple memory-safety vulnerabilities in core PHP, grouped under two CVEs with severity up to CVSS 9.2, that allow unauthenticated remote code execution and memory disclosure. Every PHP version released in the last decade is affected by at least one bug, and PHP released patches on October 21, 2026.
AIWhy it matters.
The write-up shows how AI assistance lowered the effort needed to chain and adapt a decade-old PHP flaw, with defender signals and patch details for affected sites.
Source details
Hacker News · AI (150+ points) · danlark1 · wiz.ioPublished · added here
Original title: PHP2Shell: AI uncovers critical RCE in PHP