PHP2Shell: AI uncovers critical RCE in PHP
- ID
- 37952
- Status
- summarized
- Published
- 21 Oct 2026, 9:43 PM
- Fetched
- 22 Oct 2026, 12:51 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.wiz.io/blog/php2shell-php-rce
- Source URL
- https://hnrss.org/best
Summary
- Score
- 9.0
- Created
- 22 Oct 2026, 12:52 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Wiz Research disclosed PHP2Shell, two CVEs in the core PHP engine (CVSS up to 9.2) allowing unauthenticated remote code execution and Heartbleed-style memory disclosure — leaking passwords, tokens, API keys and certificates across requests — independent of the app running on top. Every PHP release going back to 5.4 is affected by at least one flaw, and PHP shipped patches on October 21, 2026. The researchers state that the exploit chain was at the edge of what human researchers could practically achieve, and that frontier AI models substantially lowered that barrier.
Why it matters
If you run WordPress, Drupal, Joomla, MediaWiki or any PHP app — including on shared or managed hosting where you don't control the PHP build — check your PHP version today and confirm your host has applied the October 21, 2026 patch, because this is core-engine RCE, not a plugin issue. The memory-disclosure half means secrets from other requests on the same process could leak, so after patching, rotate database passwords, API keys and tokens that lived on affected servers. Also treat 'AI made a decade-old flaw exploitable' as a planning fact: your patch lag is now measured against AI-assisted exploit discovery, not human research speed.
Discussion angle
Who in the room actually knows their PHP version and their host's patch status? Walk through the check: PHP version, whether it's a managed host, and what secrets on those boxes need rotating even after the patch lands.