🚨 PHP2Shell: Wiz research uncovers CVSS 9.2 vulnerabilities & unauthenticated RCE affecting 70% of the web.
Wiz Research has released details on multiple critical vulnerabilities in core PHP. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them. All php versions >= 5.4 are affected by at least one of these vulnerabilities.
What we uncovered?
• Application-agnostic memory disclosure: Unauthenticated exfiltration of live PHP worker memory (dumping authentication tokens, passwords, API keys, and certificates).
• Reliable remote code execution primitives underlying the PHP engine itself, impact is application-agnostic and affects any PHP application (yes, even a literal Hello World application).
• Confirmed unauthenticated pre-auth RCE on WordPress, Drupal, and Joomla.
#PHP2Shell marks an inflection point: AI changes the practical exploitability of longstanding vulnerabilities. Frontier models (Wiz Atlas, GPT-5.6-Sol, and Gemini 4 Argon) were used to hunt down and chain these 10-year-old flaws in under a week, with Gemini 4 making a particularly significant contribution.
What security teams need to do?
1) Patch: patch immediately, or migrate containerized workloads directly to pre-patched WizOS PHP base images, available for free for 60 days for all Wiz customers for instant, verified remediation.
2) Mitigate: Deploy WAF/CDN virtual patches and out-of-the-box mitigations.
3) Monitor: Check for unusual multipart requests, memory-limit/500 errors, malformed PHPSESSID cookies, or worker churn.
Kudos to Gemini, PHP Core, OpenAI, Calif, and industry partners for the coordinated disclosure.
👇 Full technical breakdown & PoC: wiz.io/blog/php2shell-php-rce
