AI finds PHP flaw that lets attackers hijack 70% of the web
PHP2Shell: AI uncovers critical RCE in PHP
Wiz Research used frontier AI to uncover critical memory-safety bugs in core PHP, including unauthenticated remote code execution and memory disclosure. Every PHP version since 5.4 is affected, impacting WordPress, Drupal, Joomla, and other platforms. The flaws, hidden for over a decade, were chained into working exploits in hours with AI assistance. Patches are available, and immediate updating is urged.
The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.