AI finds PHP2Shell bugs that let attackers hijack 70% of the web
Wiz Research, with OpenAI Codex Security and Calif, uncovered a family of critical PHP core vulnerabilities rated CVSS 9.2, tracked as CVE-2026-109618 and CVE-2026-109619. They allow unauthenticated attackers to execute code or leak process memory on roughly 70% of websites, including WordPress, Drupal and Joomla. The PHP team shipped fixes across branches 8.2 through 8.5; upgrading the runtime is the only complete remedy.
Websites can be affected even when their application code is secure, including a simple "Hello World" application running on an affected PHP version.