AI Helps Researchers Uncover Critical PHP Flaws Found in Nearly Every Version

Can attackers take over PHP servers without logging in?

Attackers could take control of servers running the PHP programming language without logging in, according to security researchers at Wiz Research, who disclosed a set of critical flaws in the code on Oct. 21. Nearly every PHP version is affected, including releases going back to PHP 5.4. The language powers an estimated 70% of websites, including those built on WordPress, Drupal and Joomla.

The company says the vulnerabilities could also let attackers read sensitive data from a server’s memory, including passwords, authentication tokens, API keys and certificates belonging to other users or the server itself. The flaws sit in PHP’s core engine, so they can affect a website even when its own application code is secure.

Wiz tracked the issues under two CVEs, CVE-2026-109618 and CVE-2026-109619, with severity reaching a CVSS score of 9.2. The bugs themselves are not new. Wiz says they had been present in the PHP codebase for more than a decade, but turning them into working attacks required chaining several flaws together and adjusting each attack to the memory layout of a specific target. That work was slow and specialized.

How did AI help researchers find the PHP flaws?

Wiz says AI changed that calculation. The company used Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol throughout the research. Wiz credits Gemini 4 Argon with making an important contribution to finding the vulnerabilities, developing the exploit, detecting attacks and validating the patch. Models helped adapt the exploit to different PHP versions and configurations, and they analyzed failed tests and adjusted the code to fix them. Wiz said its team built working exploits across multiple applications in hours.

The company combined the flaws into a single exploit script it calls php2shell. Wiz said the script could execute code remotely on default deployments of WordPress, Drupal and Joomla, using their latest container images at the time of testing. Those platforms serve as demonstrations, the company said. A simple “Hello World” application running on an affected PHP version could also be vulnerable.

Wiz described the bugs as memory-safety issues tied to how PHP handles fatal errors during request processing, particularly out-of-memory errors. When a request ends unexpectedly, the engine can leave behind corrupted internal state. A later request handled by the same worker can reuse that stale state, which can leak memory or corrupt it. In one case, Wiz said, an attacker could read data from outside their own request. In another, the team built a path to remote code execution against Drupal.

Wiz’s disclosure timeline began on Aug. 19, when the team first found a PHP vulnerability using its AI tools. Unauthenticated code execution was confirmed against Drupal on Aug. 20 and against WordPress on Aug. 21. Wiz reported the flaws to the PHP security team on Aug. 24. PHP acknowledged the reports and began building a fix on Sept. 21. The patched releases became available on Oct. 21, the same day the findings were made public.

The company said the four bugs it reported are only part of the problem. Other variants of the same pattern likely exist, some of them untracked, and the patch is meant to fix the underlying issue and eliminate those variants in the patched release. Wiz also credited OpenAI, the nonprofit Calif and the PHP team for their work on discovery, coordination and patch verification. Cloud and hosting companies, including Cloudflare, AWS, Microsoft, Google Cloud, Akamai, Fastly and Vercel, helped prepare guidance and mitigations for customers who cannot apply the update right away.

Raluca Ada Popa, head of Gemini Security at Google DeepMind, said the company was glad to see the model help defenders close a gap that had stood for years. “For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex,” Popa said. “We’re pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them.”

How can administrators detect PHP exploitation attempts?

Because the attacks run below the application layer, application logs may show little. Wiz advises administrators to watch for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained PHP worker churn. Wiz says applying the PHP security update is the only complete fix.

Este artículo fue escrito con la asistencia de IA.
News Factory APP - noticias agénticas para impulsar tu SEO y AEO.