PHP2Shell: Wiz Research uses AI to find severe PHP remote code execution flaws

PHP2Shell: AI uncovers critical RCE in PHP

Wiz Research used AI to find several flaws in the PHP core engine that allow unauthenticated remote code execution or process memory leaks. PHP released patches on October 21, 2026.

Why it matters: Wiz Research chained PHP's long-standing memory bugs into a working attack with frontier AI, lowering the effort needed to adapt complex exploits across versions and deployments.