PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.

PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.

These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk.

Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.

On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine.

These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability  required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.

In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade. The issues described below all stem from key architecture decisions, some made over a decade ago, and were grouped under two CVEs, with severity reaching CVSS 9.2. The work grew into a cross-industry effort to protect customers, find variants, deploy detections and mitigations, and verify a patch in time for coordinated disclosure.

Nearly every PHP version is affected by at least one of these issues, including releases dating back to PHP 5.4. The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.

PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure.

Some vulnerabilities become turning points because they challenge fundamental assumptions about security. In 2014, Heartbleed exposed the fragility of shared infrastructure securing the internet. In 2021, Log4Shell revealed how deeply embedded software dependencies could create widespread exposure that organizations struggled to identify. We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities. Building the exploit required chaining multiple flaws and adapting to each target’s memory layout through repeated testing and debugging. Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours. As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.

Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification. OpenAI and Calif also published blogs containing details on the vulnerability – its history, technical details, and insight into the disclosure process. PHP posted as well.

We’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations for customers who cannot apply the patch immediately.

Wiz customers should refer to the Wiz Threat Intel Center advisory for PHP2Shell, which includes built-in coverage for agentless and runtime vulnerability detection, exploitation detection via Wiz Defend and Sensor, and automatic response policies, alongside remediation and threat hunting guidance.

Sensor customers using the newest version (1.0.12768) can also enable a built-in response policy to automatically terminate processes exhibiting behaviors typical of PHP2Shell exploitation:

The Vulnerabilities

All of the disclosed vulnerabilities are memory-safety issues that stem from bugs in how PHP handles fatal errors while processing requests, particularly out-of-memory errors. These bugs can leave a corrupted internal PHP state behind after a request ends unexpectedly. A later request or worker can reuse that stale state, leading to memory disclosure or corruption.

Below you can find a table that demonstrates what type of impact was demonstrated by each of the bugs we reported to PHP. The applications listed below are targets we chose for the RCE demonstrations. They are representative targets - exploitation does not require one of these CMSs, as the vulnerable code is in PHP itself.

Upload-progress unserializer use-after-free

Unauthenticated disclosure of PHP worker memory

Pre-authentication RCE on WordPress, Drupal and Joomla

Application-agnostic remote memory disclosure

Corrupt shared PHP state and execute code

While this blog covers only four instances of exploitable bugs (grouped under two CVEs) that follow this problematic pattern, there are other tracked, and likely untracked, variants of this issue in the PHP codebase. These variants have different requirements for exploitation and can lead to different types of impact. In any case, the patch provided by the PHP team fixes the issue at its core and eliminates all variants in the patched release.

We combined these vulnerabilities into a single exploit script, php2shell, and demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupal:latest), and Joomla (joomla:latest), using their latest container images at the time of testing.

These platforms illustrate the impact, but the vulnerabilities are in PHP itself. Exploitation does not depend on a flaw in the application’s code: even a simple “Hello World” application running on an affected PHP version can be vulnerable.

Separately, we demonstrated that attackers could read sensitive data from the PHP process’s memory, including passwords, tokens, and API keys, without needing to achieve remote code execution.

Demonstrations of PHP2Shell with Wordpress, Joomla, and Drupal:

The vulnerable code had been present for more than a decade. Turning these flaws into working exploits required chaining multiple bugs and accounting for how PHP allocates and reuses memory across requests. Memory bugs are notoriously complex; differences in PHP versions, configurations and application behavior can break assumptions the exploit depends on. An attack that works against one deployment may need substantial adjustments to work against another, each requiring further analysis, testing and debugging. Pre-AI, this manual work would be difficult to implement and even harder to scale.

With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts. With testing and debugging tools, models can analyze failures and iterate on adjustments, reducing the specialist effort required for each target. This significantly lowers the barrier to scaling attacks across different deployments.

This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.

We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.

Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex. We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them.

Prior to public disclosure, Wiz Research worked with the PHP team, Calif and OpenAI on discovery, coordination and patch verification. We also partnered with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and many others to prepare customer guidance, detections and out-of-the-box mitigations for organizations that cannot update immediately.

A vulnerability in core PHP reaches far beyond a single application. PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem.

PHP's Session module can decode session data during upload-progress handling in the same pre-initialization window. The decoder stores request-owned bookkeeping in BG(unserialize). A fatal allocation failure can interrupt this path, destroy the request heap and leave the unserializer's global state published.

On a later request handled by the same worker, PHP can consume attacker-reclaimed memory as live unserializer bookkeeping. The stale state becomes a powerful memory-corruption primitive. We combined it with the memory disclosure to remove address uncertainty and achieved unauthenticated remote code execution on WordPress, Drupal and Joomla.

The WordPress, Drupal and Joomla chains are representative demonstrations. The underlying primitives exist at the PHP engine level and can affect any PHP application running on a vulnerable version.

These issues execute below the application layer, so application logs may contain little context. Until systems are patched, defenders should pay particular attention to unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn. These signals can guide an investigation. Applying the PHP security update remains the only complete remediation.

PHP parses RFC1867 multipart requests during request startup, before normal module initialization has completed. Session upload-progress handling can initialize Session state at this early stage and publish a session ID in PS(id). An out-of-memory error can abort the request before cleanup completes. PHP then destroys the request heap and may leave PS(id) pointing to the freed allocation.

A later multipart request handled by the same worker can reach the upload-progress cleanup path before normal Session initialization resets that pointer. PHP trusts the stale pointer and length as a live zend_string and URL-encodes the reclaimed heap contents into a PHPSESSID response cookie. The attack works even when the application never calls session_start(), making the issue application-agnostic. We demonstrated unauthenticated disclosure of an attacker-sized region of live worker memory containing data from outside the attacker's request.

In affected versions, PHP retains the backtrace of the most recent fatal error in EG(last_fatal_error_backtrace). A fatal out-of-memory error can destroy the request heap without undefining that executor-global value. The worker survives with a global that still points to memory from the previous request.

If the same worker emits a diagnostic early in the next request, it can access the pointer before the executor reinitializes that state. PHP then destroys or updates