PHP2Shell: AI uncovers critical RCE in PHP
TL;DR Highlight
Wiz used AI to turn a decade-old PHP core flaw into a working RCE exploit
Who Should Read
Backend or infra developers running PHP, WordPress or Drupal who must decide on emergency patching and AI-era security response
Core Mechanics
- The RCE lives in PHP core itself
- Even a Hello World app can reportedly be vulnerable, regardless of application code.
- Every release in the last decade back to PHP 5.4 is hit by at least one bug.
- Grouped under two CVEs with severity up to CVSS 9.2.
- Root cause is stale state after fatal errors
- A fatal error like out-of-memory destroys the request heap but leaves global pointers intact.
- The same worker reuses those pointers in the next request, causing memory disclosure or corruption.
- Memory disclosure alone leaks secrets
- Multipart requests can make heap contents appear URL-encoded in the PHPSESSID cookie.
- It works even if the app never calls session_start().
- Passwords, tokens and API keys may be exposed.
- AI lowered the barrier to exploit building
- AI cut the manual work of chaining bugs and adapting to each version and memory layout.
- The team built and adapted exploits for several apps in hours.
- One researcher did in a week what would have taken a top team months, per the post.
- Wiz demonstrated unauthenticated RCE on WordPress, Drupal and Joomla
- Tested on the latest container images (wordpress:latest, drupal:latest, joomla:latest).
- The research used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.
- Patching is the only full fix
- Patched releases shipped October 21, 2026 and reportedly eliminate all variants.
- Detection signals: multipart requests followed by memory-limit errors or repeated HTTP 500s, oversized PHPSESSID cookies, and worker churn.
Community Reactions
- Opinion that the disclosure story is tangled
- Commenters noted Calif and OpenAI also found the bugs, and Calif started disclosure on August 11.
- Many said it is hard to tell who found it first.
- Questions about the two-month disclosure window
- Some found a month to acknowledge the report hard to understand.
- Others wondered how the leak happened.
- Criticism of the AI-discovery marketing
- One comment said 20-year-old code is a common pattern in AI finds.
- They added that compute costs are undisclosed and the hype implies a first-ever RCE.
- Practical defense questions in comments
- Some asked whether SELinux or FORTIFY_SOURCE reduces the damage.
- Another asked where to get code to validate fixes.
- Reports of government sites going offline were also mentioned.
How to Apply
- Check PHP versions and patch first
- Run php -v on every host and container today and build an inventory.
- Upgrade to a release patched on or after October 21 and restart php-fpm or Apache.
- Hunt for attack signs in logs
- Search for multipart requests followed by memory-limit errors and repeated 500s.
- Also check for oversized PHPSESSID cookies and worker restart spikes.
- Apply interim mitigations until patched
- If you cannot patch immediately, enable your CDN or WAF vendor's out-of-the-box PHP2Shell rules.
- Review upload size limits and memory_limit to contain blast radius.
- Add AI-assisted code audits
- Have an LLM review error-cleanup paths such as OOM in old native dependencies.
- Verify every finding with a reproduction test and keep human review on fixes.
Try It
# Paste into Claude, ChatGPT or Claude Code (simplified version of the post's approach: error-path audit)
You are a security code reviewer. In the code below, find global or static state that is left uncleaned after a fatal error (e.g. OOM) aborts a request.
{{code}}
For each candidate, tell me:
1) which global/static variable is left behind
2) how the next request can reuse that value
3) how to reproduce it (test idea)
4) confidence (high/medium/low)
Next step: pick one candidate and write a reproduction test to confirm it is a real issue.Terminology
Related Papers
The Judge Can Debias Itself: Awareness and Self-Debiasing for Reliable LLM-as-a-Judge
Warning an LLM judge about bias or letting it self-critique improved 20 of 21 model–bias combinations.
90% of US working hours are spent on tasks not covered well by AI benchmarks
Mapping 29 benchmarks to job tasks shows 90% of US working hours lack good coverage
Postgres 19 delayed after AI reviewers find more bugs than humans can fix
LLM code review surfaced so many bugs that Postgres 19 slipped to November and 8-10 features were reverted
Show HN: Gemini 4 Argon plays StarCraft
LLMs wrote StarCraft bots in one hour; GPT-6 Astra scored highest.
A Plausible Explanation Is Enough to Mislead Multimodal Judges
Adding plausible explanations to fixed answers cut MLLM judges' wrong-answer rejection by 12.7–13.8 points.
Neural networks are clean
Looking at neurons directly shows most have one main job, challenging superposition.
Linus Torvalds's first LLM-assisted patch series
Linus posted an LLM-assisted 10-patch series giving an order-of-magnitude read() speedup, with a race already found.
Show HN: Parsimony – an open-source benchmark for how much code AI models add
Counting syntax units in SWE-bench patches ranks which AI models add the least code