GoKawiilWiz Research finds critical RCE flaws in core PHP affecting versions since 5.4
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
GoKawiil's interpretation of the reporting above, not reported fact.
Wiz says the flaws had existed in PHP's architecture for over a decade but were previously too complex for human researchers to reliably exploit, suggesting that frontier AI tools are lowering the bar for discovering and weaponizing deep, long-dormant software vulnerabilities. Because PHP underlies such a large share of the web, unpatched servers could remain exposed to serious compromise, making rapid patch adoption across hosting providers and CMS platforms important.
- Two critical PHP CVEs reaching CVSS 9.2 were found in the core engine, not specific applications.
- Every PHP version since 5.4 is affected by at least one vulnerability; a fix shipped October 21, 2026.
- Wiz credits frontier AI models with making exploitation of a decade-old flaw practically achievable.
Source: wiz.io, 2026-10-21
Published there as: “PHP2Shell: AI uncovers critical RCE in PHP”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.