Critical PHP Vulnerabilities Expose 70% of Web to RCE

Wiz Research identified multiple critical vulnerabilities in PHP’s core engine affecting servers running 70% of the world’s websites. The flaws enable unauthenticated remote code execution and memory disclosure independent of application security. Every PHP version since 5.4 is vulnerable due to how the language handles fatal errors—corrupted internal state from one request can be reused by later requests on the same worker process.

PHP released patches on October 21, 2026, addressing two CVEs with CVSS 9.2 severity. The memory-safety bugs persisted for over a decade, but developing practical exploits required chaining multiple flaws and adapting to different deployments through repeated testing. Frontier AI models including Gemini 4 Argon and GPT-5.6 Sol dramatically reduced this barrier, enabling researchers to develop working exploits across multiple applications in hours. Wiz demonstrated remote code execution on the latest versions of WordPress, Drupal, and Joomla, and showed attackers could extract sensitive data including passwords and API keys from PHP process memory.

The discovery represents a potential inflection point in security, illustrating how AI changes the practical exploitability of longstanding vulnerabilities. Flaws previously considered impractical to exploit are now viable targets as AI reduces the specialist effort required for exploit development and adaptation.