Wiz Research discovered critical flaws in PHP that could let attackers take over vulnerable web servers or steal sensitive information.
The vulnerabilities affect a broad range of PHP versions, putting websites and applications across the internet at risk.
PHP released security updates October 21, and website operators are being urged to install them immediately.
Wiz Research has uncovered multiple critical security vulnerabilities in PHP, a widely used scripting language that the company estimates powers about 70% of the world’s websites.
Collectively dubbed “PHP2Shell,” the flaws could allow attackers to seize control of affected servers, steal information, or alter websites. Because the weaknesses reside in PHP’s underlying engine, even websites with otherwise secure application code can be vulnerable.
For consumers, the potential consequences include exposed information and compromised websites. The disclosure establishes a serious vulnerability; it does not, by itself, establish that a particular website or customer’s data has been breached.
The findings have been grouped under two vulnerability identifiers, CVE-2026-109618 and CVE-2026-109619. Both carry a critical severity rating of 9.2 out of 10, according to Google Cloud’s advisory. Affected releases stretch back to PHP 5.4.
Affected platforms
PHP underpins popular platforms including WordPress, Drupal, Joomla, and MediaWiki, the software behind Wikipedia. Wiz demonstrated attacks against WordPress, Drupal, and Joomla deployments that allowed code execution without requiring a login. Researchers also demonstrated access to server memory containing passwords, authentication tokens, and other sensitive credentials.
The bugs involve how PHP handles memory and cleans up after serious processing errors. Invalid internal data can remain available for later requests, creating opportunities for attackers to expose information or execute malicious instructions.
Artificial intelligence played a significant role in the discovery. Wiz said it used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to investigate longstanding weaknesses and develop working demonstrations. The company said AI substantially reduced the effort needed to turn complex memory bugs into practical attacks.
OpenAI said security company Calif independently identified a critical flaw using GPT-5.6 Sol. PHP’s maintainers led the fixes, with researchers and security providers coordinating protections ahead of disclosure.
Updating is the highest priority
For website operators, the immediate priority is updating PHP. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP’s security team says all installations serving web requests are at risk and that updating is the only complete solution.
Business owners who rely on a hosting company should ask whether the PHP security fixes have been applied to their sites. Updating a content management system alone does not establish that its underlying PHP installation has been patched.
Operators using PHP 8.1 or older should consult their software vendor about backported fixes or move to a supported release. PHP says some Linux distributions and long-term support vendors provide those fixes, while temporary configuration changes only reduce exposure to specific attack paths.