Wiz Research reported two remote code execution vulnerabilities in PHP, called PHP2Shell, to the PHP team on August 24. The PHP team began working on fixes on September 21. According to the source, Amazon detected PHP2Shell in the wild on October 17, four days before disclosure. Details of the two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, leaked prematurely on October 20. The PHP team released patches on October 21.
Wiz says the vulnerabilities affect PHP versions going back to PHP 5.4. The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and said all PHP instances need to be updated to one of those releases. Sites that cannot be updated should be taken offline and isolated.
According to the source, Wiz used its own model, Wiz Atlas, along with Gemini 4 Argon and GPT-5.6 Sol to find the vulnerability. Wiz said the underlying flaws had been present for decades but required an exceptionally complex chain of steps. In Wiz's words, "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an