PHP patches remote code execution flaws found with AI assistance
What happened
On October 21, 2026, Hacker News' front page covered a vulnerability discovery called "PHP2Shell." Wiz Research used AI to find several flaws in the PHP core engine that could lead to unauthenticated remote code execution or process memory leaks. The issue concerns memory safety in the PHP core engine, not a single application. PHP released patches the same day. The report did not disclose affected versions, the number of flaws, or whether any were exploited.
Written by AI from the coverage · updated 53 minutes ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pagePickPHP2Shell: Wiz Research uses AI to find severe PHP remote code execution flaws
Wiz Research used AI to find several flaws in the PHP core engine that allow unauthenticated remote code execution or process memory leaks. PHP released patches on October 21, 2026.
Heat over time
Not enough continuous observations to draw a trend yet.