Some security flaws hide in an obscure plugin. PHP2Shell hides in the engine itself. On October 21, 2026, Wiz Research publicly disclosed two critical vulnerabilities in core PHP, the scripting language that powers about 70 percent of the world's websites, including WordPress, Drupal, Joomla and Wikipedia's MediaWiki software. Grouped under CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2, the flaws can let an attacker who has no account at all execute code on an affected server, or read its memory.
The bugs are memory-safety problems rooted in how PHP handles fatal errors, particularly when a request runs out of memory. A request that dies at the wrong moment can leave corrupted internal state behind, and a later request handled by the same worker can reuse that stale state. Wiz chained the weaknesses into a single exploit script and demonstrated pre-authentication remote code execution against current WordPress, Drupal and Joomla container images. The team stresses that those platforms are only representative: because the vulnerable code sits in PHP itself, even a simple Hello World application on an affected version can be exposed.
The second danger needs no code execution at all. Wiz also demonstrated unauthenticated disclosure of PHP worker memory, which can contain passwords, authentication tokens, API keys and certificates belonging to other requests or to the server itself. That makes patching urgent even for sites that consider their own application code carefully audited. Nearly every PHP version released in the last decade is affected by at least one of the issues, going back to PHP 5.4, and Wiz says the underlying architecture decisions date back more than a decade.
What makes the discovery a landmark is how it was found. The flaws survived years of human review because proving them exploitable required chaining several subtle memory bugs and adapting the attack to different versions, configurations and memory layouts. Wiz used its Atlas tooling alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol throughout the research, crediting Argon in particular with helping find the vulnerability, develop the exploit and validate the patch. The security firm Calif independently found one of the flaws using GPT-5.6 Sol. Wiz says a single researcher with frontier models did in about a week what once would have taken a world-class team months.
That cuts both ways, and Wiz is candid about it. The same ability that helps defenders find old flaws also lowers the barrier to adapting exploits across deployments, so bugs once dismissed as impractical may now be viable targets. The response therefore moved fast. Wiz reported the flaws to the PHP security team on August 24, PHP acknowledged them in September, and patched releases arrived on October 21, the day of public disclosure. According to multiple reports, the fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cloudflare told USA Today it had already observed exploit attempts, including spikes of thousands of attempts, while the National Security Agency advised organizations that could not patch immediately to take vulnerable systems offline.
For anyone running a PHP site, the guidance is unusually simple: update the PHP runtime itself, not just the application on top of it, and treat the update as emergency maintenance. Wiz notes that application logs may show little context because the attack happens below the application layer, so unusual multipart requests, repeated memory-limit errors and unexpected worker restarts are worth a close look until every instance is patched. A flaw this old, in software this widespread, found this quickly by AI, is a clear signal that the backlog of long-ignored bugs in foundational code is now fair game, for defenders and attackers alike.