Wiz Research has disclosed multiple critical vulnerabilities in PHP, the programming language powering approximately 70% of all websites worldwide. According to the research, successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites.
PHP powers major platforms including WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki. The vulnerabilities exist in PHP’s core engine independent of applications running on top of it, putting every affected website at immediate risk.
The flaws stem from memory-safety issues in how PHP handles fatal errors during request processing, particularly out-of-memory errors. These bugs can leave corrupted internal PHP state that later requests or workers reuse, leading to memory disclosure or corruption. According to Wiz Research, every PHP version released in the last decade is affected by at least one vulnerability, with versions going back to PHP 5.4 impacted.
Two CVEs were assigned with severity reaching CVSS 9.2. The first (CVE-2026-109618) involves an upload-progress unserializer use-after-free vulnerability enabling remote process-memory disclosure and pre-authentication remote code execution on WordPress, Drupal, and Joomla. The second (CVE-2026-109619) is a fatal-error backtrace use-after-free causing OPcache type confusion, also enabling pre-authentication RCE.
Researchers demonstrated the vulnerabilities through an exploit script called php2shell, which executed code remotely without authentication on latest container images of WordPress, Drupal, and Joomla. They also showed attackers could read sensitive data from PHP process memory, including passwords, tokens, and API keys, without achieving remote code execution.
According to Wiz Research, these vulnerabilities remained hidden for over a decade due to the complexity of exploitation. The underlying flaws trace to architecture decisions made years ago. However, frontier AI models substantially reduced the barrier to exploitability. The research indicates that turning these flaws into working exploits requires chaining multiple bugs and accounting for PHP memory allocation across requests—work that would previously demand significant manual effort but can now be scaled using AI assistance.
On October 21, 2026, PHP released patches fixing the memory-safety vulnerabilities. Immediate patching is strongly advised for all affected systems. The research represents cross-industry collaboration involving PHP, OpenAI, and major cloud and infrastructure providers including Google, AWS, Cloudflare, and Microsoft.
Key facts
- Every PHP version from 5.4 onward is affected by at least one vulnerability
- The vulnerabilities allow unauthenticated remote code execution on unpatched servers
- PHP powers approximately 70% of all websites, including WordPress, Drupal, and Joomla
- Two CVEs were assigned with maximum CVSS severity of 9.2
- The vulnerabilities stem from memory-safety bugs in PHP’s fatal error handling
- Researchers used frontier AI models to develop working exploits across multiple applications
- PHP released patches on October 21, 2026