Security brief

PHP2Shell research demonstrated core PHP flaws, with AI used for discovery

REVIEW

The affected technology is PHP; the models that helped researchers investigate it are discovery tools, not affected products.

Published 29 Oct 2026 · Material update 21 Oct 2026 — last time the underlying evidence changed · Evidence: high

What happened

Wiz disclosed PHP2Shell, a group of memory-safety findings in core PHP tracked under CVE-2026-109618 and CVE-2026-109619. The research demonstrated memory disclosure and code-execution paths, including examples against popular content-management systems.

The researchers say PHP released coordinated fixes on October 21, 2026. Exploit conditions vary across the underlying bugs; PHP’s large market share should not be presented as a measured count of compromised websites.

Operators should apply the security update for their supported PHP branch and verify the runtime used by deployed applications. AI models helped discover and analyze the flaws; that role does not make those models or their vendors affected PHP products.

Read the original source.

Next step

Apply the security update for your supported PHP branch and verify deployed runtimes.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2026-109618
CVE
CVE-2026-109619