Wiz Researchers Detail PHP Memory-Safety Flaws Enabling Unauthenticated RCE
Summary
Wiz researchers describe PHP memory-safety flaws affecting versions back to 5.4, enabling unauthenticated RCE and process-memory disclosure. PHP released patches on October 21, 2026; AI models helped develop and adapt exploits.
Key points
- The flaws, grouped under CVE-2026-109618 and CVE-2026-109619, include use-after-free bugs and OPcache type confusion.
- Researchers demonstrated unauthenticated RCE on WordPress, Drupal and Joomla, plus disclosure of PHP worker memory.
- The vulnerable code is in PHP itself, so affected deployments may be vulnerable regardless of their application code.
- The issues affect PHP releases dating back to version 5.4; the researchers say the flaws had been present for more than a decade.
- PHP released patched versions on October 21, 2026; the article says patching is the only complete remediation.
- Wiz says frontier AI models helped discover the flaws and develop and adapt working exploits across applications.
Article Details
- Attack Vectors
- Unauthenticated remote exploitation of memory-safety flaws in the PHP core, including upload-progress unserializer and fatal-error backtrace use-after-free conditions and an OPcache type confusion.
- Multipart HTTP requests can trigger vulnerable upload-progress processing; an out-of-memory error may leave stale state that a later request handled by the same worker reuses.
- A later request can disclose worker memory through a PHPSESSID response cookie or use reclaimed memory to achieve remote code execution.
- Defensive Notes
- Apply the PHP security update released on October 21, 2026; the article identifies patching as the only complete remediation.
- Until patched, investigate unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn.
- Wiz customers can use the article-described vulnerability and exploitation detection, threat hunting, and response policies; Sensor customers on version 1.0.12768 can enable a policy to terminate processes exhibiting typical PHP2Shell exploitation behavior.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThe demonstrated exploit achieves unauthenticated remote code execution by targeting vulnerable PHP deployments exposed through WordPress, Drupal, and Joomla.T1528 · Steal Application Access TokenThe flaws can disclose PHP worker memory containing authentication tokens; the article also reports exposure of passwords, API keys, and certificates.
CVE
People
Nir OhfeldNamed as a member of the Wiz Research Team.Raluca Ada PopaIdentified as Head of Gemini Security at Google DeepMind and quoted on Gemini 4 Argon's contribution to the research.Sagi TzadikNamed as a member of the Wiz Research Team.Shir TamariNamed as a member of the Wiz Research Team.Tomer SchwartzNamed as a member of the Wiz Research Team.
Vendors
AkamaiWe’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations forAmazon Web ServicesWe’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations forCloudflareWe’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations forFastlyWe’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations forGoogleWe’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations forImpervaalso like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations forMicrosoftto express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations for customers whoOpenAIWiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification. OpenAI and Calif also published blogs containing details on the vulnerability – itsPHPWiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to takeWizWiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take
Products
DrupalPHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.JoomlaPHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.PHPWiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to takeWiz Defendbuilt-in coverage for agentless and runtime vulnerability detection, exploitation detection via Wiz Defend and Sensor, and automatic response policies, alongside remediation and threat hunting guidance.WordPressPHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.
Tools
Gemini 4 ArgonWe used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation ofOpenAI GPT 5.6 SolWe used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation ofphp2shelldependencies could create widespread exposure that organizations struggled to identify. We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practicalWiz AtlasWe used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of