PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Summary
Wiz Research reveals critical vulnerabilities in the core PHP engine that enable unauthenticated remote code execution and memory disclosure, potentially affecting 70% of websites. The flaws span multiple CVEs and versions, with a patch released by PHP on Oct 21, 2026. The findings highlight how frontier AI facilitated exploit discovery and patch verification, prompting cross-industry coordination and rapid remediation.