AI Found PHP's Most Severe Vulnerabilities in a Decade in Two Days
PHP's Most Severe Vulnerabilities in a Decade, Found by AI in Two Days
Wiz Research disclosed multiple memory safety vulnerabilities in PHP core (CVE-2026-109618/CVE-2026-109619, CVSS up to 9.2), enabling...
When every service depending on this supply chain is alerting
Business Objective: RCE Defense at the PHP Core Layer
PHP's Position and Exposure in Global Website Infrastructure
PHP underpins about 70% of active websites, and that number has barely changed in the past decade. WordPress, Drupal, Joomla, Magento, and many government and enterprise internal systems are built on PHP. More importantly, PHP also runs heavily in high-concurrency e-commerce, finance, and government scenarios.
A security flaw in the PHP core is not “some application's bug”; it is a problem in the trust root of the entire infrastructure. Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal explicitly: “This is the most serious problem PHP has had in more than ten years.”
Scope and Severity of These Vulnerabilities
CVE-2026-109618 and CVE-2026-109619 are both rated CVSS v4.0 9.2 (Critical). They share the same characteristics: no authentication required, remotely triggerable, and arbitrary code execution.
CVE-2026-109618 arises during out-of-memory (OOM) interruption scenarios: when PHP handles a large file upload, a heap allocation failure leaves internal request data structures in an uninitialized state. CVE-2026-109619 exploits leftover global state on a fatal error path, allowing an attacker to hijack the execution flow.
More severe is the memory leak problem. Sansec's analysis points out that even if an application never calls session_start(), a malicious request can read other session tokens, API keys, and even TLS private keys in the same process. This extends the attack path from simple RCE to a dual threat of “RCE + passive credential theft.”
Wiz Research's PoC tool PHP2Shell claims compatibility with all versions of PHP 5.4.0 and above. About 60% of public-facing PHP servers worldwide are already unsupported because their versions are too old.
When ops for all PHP sites receive alerts at the same moment
Figure 1
Sub[WordPress / Drupal / Joomla / Magento / government websites / enterprise internal systems] Core[PHP core layer memory handling flaws] Attack1[Attack vector 1 OOM interruption + UAF] Attack2[Attack vector 2 fatal error path + state residue] Impact[Impact RCE + memory leak unauthenticated remote execution] Sub --> Core Core --> Attack1 Core --> Attack2 Attack1 --> Impact Attack2 --> Impact Impact --> Compromise[full server takeover sensitive data exfiltration]
The root reason these vulnerabilities could hide in the core layer for years is PHP's memory management model. PHP uses a custom heap allocator, zalloc, which reuses memory blocks within the request lifecycle. When OOM causes a memory block to be freed early while references are not zeroed, subsequent requests read residual data from the previous request. This is a classic Use-After-Free class of problem, but it is amplified by the FPM concurrency model in PHP's SAPI layer, and traditional static analysis tools struggle to trace it.
Business objective: RCE at the PHP core layer
Business objective: RCE defense at the PHP core layer
Option A: Traditional Manual Audit Path
Historical Discovery Cycles and Manpower for Major PHP Vulnerabilities
Historically, discovery of severe PHP vulnerabilities has relied on security researchers' long-term tracking or vendor-internal code review. Take CVE-2018-12889 as an example: that vulnerability existed in the PHP 7.x branch for years, and was eventually found by an external researcher through systematic code audit. The entire process took months.
The traditional security audit workflow includes three stages: source code review, manual path tracing, and PoC writing and validation. Taking the Zval memory management module of the PHP engine as an example, a researcher needs to understand its reference counting mechanism, copy semantics, and compound type handling before they can locate potential error paths.
Fix records from PHP 7.4 show that a single severe vulnerability has an average fix cycle of 3–6 weeks. According to PHP's official security logs, of the 47 critical vulnerabilities disclosed between 2015 and 2020, 40% took more than a year to discover.
Bottlenecks of Traditional Fuzzing and Code Audit
The core assumption of traditional fuzzing is that random sampling of the input space can cover abnormal paths at boundary conditions. For a language with a dynamic type system like PHP, that assumption faces two structural obstacles.
First, PHP's internal request lifecycle involves multi-stage state machine transitions. The execution order of session.upload_progress, GC cleanup, memory reallocation, and other operations depends on runtime context; fuzzing based purely on HTTP input can hardly reach deep internal state combinations.
Second, triggering a memory safety vulnerability usually requires a specific combination of execution paths. The core mechanism of CVE-2026-109618 is that after an OOM interrupt, internal request data structures are only partially initialized. When the cleanup routine reads uninitialized heap memory, it makes wrong branch decisions based on garbage data. Traditional single-point fuzzing can almost never cover this “stacked conditions” type of vulnerability.
Frankly, using random input to hit the boundaries of PHP memory management has a hit rate barely better than winning the lottery.
Fuzzing frameworks such as AFL++ and libFuzzer have a large number of successful cases on C/C++ projects, but their effect is limited at the application layer of an interpreted language like PHP. Fuzzing coverage of the PHP engine itself has long stayed around 60%.
Why These Vulnerabilities Might Have Been Discovered Late Under Traditional Processes
The shared characteristics of CVE-2026-109618 and CVE-2026-109619 make them easy to overlook in traditional audit processes.
First, both trigger conditions depend on a combination of “exception path + uninitialized memory.” Only under abnormal branches such as OOM interruption and fatal errors does the reading of uninitialized fields become visible.
Second, exploitation requires constructing a specific request context. An attacker needs to trigger memory reallocation through the session.upload_progress module while precisely controlling request execution timing.
Finally, PHP 5.4+'s backward-compatibility design has left historical baggage. Early session handling logic was repeatedly refactored in later iterations, but some boundary behavior was preserved. This “living fossil” code rarely becomes the focus of security review.
Source code browsing
Option A: Traditional manual audit path
Option A: Traditional manual audit path
Option B: AI-Assisted Security Research Path
How Wiz Research Used Gemini 4 Argon and GPT-5.6 Sol to Locate the Vulnerabilities
Wiz Research researcher sagitz left a one-line record on X: “The research started with a prompt targeting security flaws in PHP functions.”
The concrete path started from accessible functions in popular codebases, asking the models to list internal processing chains that external data could trigger. Gemini 4 Argon handled source-level analysis, tracing how parameters flow from zval structures into memory allocation logic; GPT-5.6 Sol handled behavior inference, determining under what input conditions a code path triggers abnormal state transitions.
The two worked in serial relay: after Gemini 4 Argon produced suspicious call stacks and Sol modeled their behavior, the researcher used Sol to generate PoC code for validation. After three iterations, each of the two independent vulnerabilities had a reproducible attack chain.
“As expected in 2026, AI did most of the work here.” — sagitz, Wiz Research
AI's Division of Roles in Source Analysis, Behavior Inference, and PoC Generation
The three key stages of traditional audit, code scanning, logical reasoning, and vulnerability validation, were split this time into three tasks at different levels.
Source scanning is grunt work. The C code in PHP core has accumulated over decades, and its function call chains are intricate. Gemini 4 Argon's job was to compress the question “is this function called by a public interface” from days to hours.
Behavior inference is judgment work. After a suspicious code path is found, someone must judge whether that conditional branch can be reached under normal requests. In this part, GPT-5.6 Sol showed a clearer advantage: it can combine discrete code fragments into a complete attack scenario description.
PoC generation is engineering work. In this step, Sol acts like “an intern who can write correct C syntax”: it does not invent mechanisms that do not exist, but it can combine known memory operations into an executable request body.
“Tracing PHP function call chains from popular codebase entry points”
How the Discovery Cycle Compressed from Months to Two Days
The bottleneck in traditional vulnerability research is not computing power, but the cost of information retrieval. The PHP core codebase exceeds one million lines, and building a call graph by hand takes a lot of accumulated time.
What the AI models change is search efficiency in the first phase. Given the module name “session.upload_progress,” Gemini 4 Argon can locate all potentially triggerable code branches within hours. Information gathering that used to take a researcher a week now fits into a few hours of conversation.
The second phase is hypothesis validation. The traditional flow requires a researcher to manually construct test cases and run debug builds. With AI assistance, the researcher can directly ask the model to generate test scripts based on suspicious paths. Two days is enough for three iterations: locate → verify → correct.
The more critical change happens at the collaboration level. OpenAI, Calif, and Quarkslab formed a distributed verification network during the patch validation phase. After the patch was submitted, multiple teams tested different input conditions in parallel, cutting the time to find edge cases from days to hours.
Option B: AI-assisted security research path
Option B: AI-assisted security research path
Option C: Hybrid Defense and Defensive Practice
Temporary Protection Strategies Before the Patch Takes Effect
Cloudflare CTO Dane Knecht quickly deployed WAF rules after the vulnerability leaked, explicitly labeling them “temporary emergency measures.” That means the rules cover known attack vectors, but they do not equal fixing the vulnerability itself.
For sites running WordPress, Drupal, Joomla, or Magento, the protection priorities are: confirm whether the PHP version is within the supported range, check whether session.upload_progress is enabled, and disable file upload progress reporting or restrict upload endpoints before a patch is available.
mod_php configuration carries the highest risk. When Apache executes PHP through mod_php, all requests go through the same process. In contrast, PHP-FPM isolates via the FastCGI protocol, with each request handled by an independent worker, so the mitigation effect is more obvious.
On the detection side, Elastic and Corelight both shipped Suricata and Zeek rules before the patch was released. The coverage window for such rules is usually short: once attackers adjust the payload structure, the rules stop working.
How Detection Rules and Patches Work Together
On the day the patch was released, global automated scanning began. Sansec estimates that mass attacks will appear within 15 minutes of the patch going live.
The key to a defense system is not detecting an attack per se, but distinguishing “normal traffic” from “exploitation attempts.” The right detection strategy should shift from “is this request legitimate” to “does this request carry data structures that should not appear on the session handling path.”
WAF rules can block known signature patterns, but they are helpless against unknown variants. That is why multi-party validation of patch effectiveness is necessary.
Figure 4
Long-Term Governance: Who Pays for the PHP Core Layer
PHP is maintained by the PHP Foundation, a non-profit organization with a limited core development team. In this incident, from vulnerability discovery to patch release, the official team took about two months.
The bigger question is: who should be responsible for sustained security investment in the PHP core layer? About 70% of the world's websites run on PHP, but the flow of money between ecosystems like WordPress, Drupal, and Magento and the PHP Foundation is not transparent.
Behind sagitz's summary “AI did most of the work here” is a more worthwhile question: if AI can do in two days what traditional audits took months to do, where is the economic value of the traditional audit model? The answer is not in speed itself, but in knowledge accumulation. The codebase understanding, historical vulnerability patterns, and edge-case lists that traditional researchers build over months are tacit knowledge that AI cannot automatically inherit.
Option C: Hybrid defense and defensive practice
Option C: Hybrid defense and defensive practice
Selection Decisions and Execution Recommendations
Decision Matrix: How to Combine Traditional Audit, AI Assistance, and Hybrid Defense
The three paths are not mutually exclusive; they apply to different stages.
At the discovery stage, AI assistance costs far less than traditional audit. Given a clear entry point, a model can complete in hours what would take a human weeks of information gathering. But the model's output needs human validation: hallucinations and false positive rates still exist.
At the validation stage, traditional manual audit still has irreplaceable value. AI-generated PoCs may cover the main path, but edge cases and concurrency conditions require human researchers to make judgments in code context.
At the defense deployment stage, a hybrid strategy is the most robust. WAF rules provide immediate mitigation, patch validation ensures the fix works, and continuous monitoring captures anomalous behavior.
An Actionable Three-Step Checklist
Things you can do today:
Check the PHP version in all production environments. Log into the server and run
php -v, recording the version number and compile options. Unsupported versions should get an immediate upgrade plan.Confirm the session.upload_progress configuration. Search php.ini for
session.upload_progress.enabled; for temporary mitigation, set it to Off, but this affects the normal upload progress display feature.Deploy signature-based temporary detection rules. Refer to the Suricata/Zeek rules released by Elastic and Corelight to add monitoring coverage at the traffic layer.
Things you can do next week: evaluate whether third-party security products have integrated detection for CVE-2026-109618 and CVE-2026-109619, and contact hosting providers to confirm update plans for underlying PHP versions.
Boundary: AI Vulnerability Hunting Is Not a Silver Bullet
The limitations of AI-assisted security research need to be clear:
First, AI's discovery ability depends on prompt quality. Give it the wrong starting point, and the model may spend the same time finding irrelevant problems.
Second, AI cannot replace an understanding of how code evolved historically. The PHP core contains some design decisions that look unreasonable but are historical leftovers.
Third, AI-generated PoCs do not necessarily cover all trigger conditions. Models tend to generate the most direct attack path.
The flagship model you bought instantly turns into a budget replacement package.
When AI can complete 80% of a traditional audit, the remaining 20% is where human intelligence is truly needed.
Selection decision: the applicable boundary of AI-assisted security research
Selection Decision: The Applicable Boundary of AI-Assisted Security Research
AI's value in this kind of vulnerability discovery depends on a specific engineering condition: whether the complexity of the attack chain exceeds what a single engineer can reason through in a reasonable amount of time.
The two PHP2Shell vulnerabilities belong to the same class of problem: use-after-free caused by memory management errors. But proving they can be exploited requires constructing a precise request sequence that makes the OOM interrupt happen at the right moment. Validating that chain in the real engine means walking through multiple subsystems of the PHP kernel.
When AI Assistance Is Appropriate: Thresholds of Complexity and Attack Surface
There are three signals for when to bring in AI.
First, broad attack surface coverage. PHP2Shell affects every version starting from at least 5.4, involving multiple SAPIs and dozens of extensions. AI can converge quickly through parallel analysis and pattern matching.
Second, long validation path. From vulnerability discovery to a stable PoC, traditional methods can take more than two weeks of repeated debugging. AI can generate multiple candidate PoCs within a few conversation rounds.
Third, large knowledge span. The PHP kernel itself is complex enough; with interactions across Zend Engine, libxml, openssl, curl, and other extensions, a single researcher's knowledge blind spots significantly increase the probability of missing something.
When Human Leadership Is Still Required: False-Positive Filtering and Deep Logical Judgment
AI's limitations are equally clear. The first problem is false positives. A model can generate ten PoCs that look plausible, and only two of them may actually reproduce on the target version.
The second problem is judgment about the nature of the vulnerability. AI can tell you that a code path “looks dangerous,” but it cannot replace a security engineer's judgment about whether that danger constitutes an actual threat.
The third problem is the reasonableness of the fix. A patch not only has to solve the vulnerability; it also has to preserve backward compatibility.
Selection Decision Table: Traditional vs. AI vs. Hybrid Path by Applicable Scenario
Manual source code audit
| Deep mining of known vulnerability types | Traditional + AI assistance | Human experience leads, AI accelerates | | Pattern scanning of large codebases | AI assistance + human validation | Coverage breadth first, precision depends on humans | | Exploratory research on new attack surfaces | Hybrid path | High uncertainty, needs fast trial and error | | Reasonableness assessment of vulnerability fixes | Traditional path primarily | Requires engineering experience and architectural understanding |
Architecture Overview: The Full Chain from Vulnerability Discovery to Patch Deployment
The value of the PHP2Shell incident is not just that two vulnerabilities were found. What is more worth observing is how compressed the entire response chain has become.
Figure 6
The PHP Foundation's response was to “move the patch timeline earlier.” This was not the optimal choice, but it was the realistic one: the information had already leaked, and waiting would only give attackers more time to prepare.
Cloudflare CTO Dane Knecht deployed WAF rules before the patch was released. His exact words: “WAF rules are only temporary emergency measures; administrators are urged to apply the official patch as soon as possible.”
Closing Assessment: AI Is Not a Replacement, It Is an Amplifier
The PHP2Shell incident gives a clear judgment: AI did not replace security researchers, but it compressed the gap between “someone knows” and “no one knows” to two days.
Under the traditional path, vulnerability discovery often depends on an individual researcher's focused effort and deep understanding of a specific codebase. That model produces high-quality conclusions, but speed and coverage are limited by human capacity.
The AI-assisted path has brought the cost of “discovery” down to a new order of magnitude. Gemini 4 Argon and GPT-5.6 Sol completed source analysis, behavior inference, and PoC generation. But vulnerability validation, patch reasonableness assessment, and detection rule development still require human judgment.
When sagitz says “AI did most of the work here,” he means AI handled the most time-consuming and tedious parts of the research process. This is not a replacement argument; it is a division-of-labor argument.
For enterprise security teams, the direct action recommendations from this incident are threefold. First, check PHP versions immediately; all PHP 5.4 and above versions need to be upgraded to the latest security release. Second, before the patch takes effect, use temporary detection rules released by vendors such as Cloudflare, Elastic, and Palo Alto, focusing on abnormal requests to the session.upload_progress module. Third, re-evaluate internal security research investment strategy.
In the end, PHP2Shell's significance is not the two CVEs, but the trend it reveals: AI is becoming infrastructure for security research. It does not replace the researcher's judgment, but before the researcher judges, it has already narrowed the space of possibility down to an actionable boundary.
References
- Wiz Blog - PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet. https://www.wiz.io/blog/php2shell-php-rce
- sagitz on X - PHP2Shell research notes. https://x.com/sagitz_/status/2112901387122332066
- Elastic Security Labs - php2shell: Assessing detection coverage. https://www.elastic.co/security-labs/threat-command/php2shell-php-rce-detection
- Corelight - PHP2Shell Zeek and Suricata Detections. https://corelight.com/blog/php2shell-detection-before-disclosure
- Sansec - Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619. https://sansec.io/research/php2shell
- PHP Foundation - Emergency security advisory. https://www.php.net/security/
Further Reading
- Original archive: https://tobemagic.github.io/ai-magician-blog/posts/2026/10/22/php爆出10年来最严重漏洞ai只花了2天就挖出来了/
- WeChat official account: Computer Magician
