"PHP2Shell": AI-Assisted Research Finds Pre-Auth RCE in PHP Core Affecting Every Version Back to 5.4, Added to CISA KEV in Five Days (CVE-2026-109618, CVE-2026-109619)

PHP core (nearly every release back to PHP 5.4), with demonstrated unauthenticated RCE against default latest container images of WordPress, Drupal, and Joomla

Wiz Research disclosed four memory-safety bugs grouped under two CVEs (up to CVSS 9.2): two use-after-frees, a remote process-memory disclosure, and an OPcache type confusion. Wiz used its Atlas agent, Gemini 4 Argon, and GPT-5.6 Sol for discovery, exploit development, and porting exploits across PHP versions, configurations, and memory layouts. The first bug was found August 19, 2026, RCE on Drupal and WordPress was confirmed by August 21, and PHP patched on October 21. Wiz says one researcher did in a week what would previously have taken a world-class team months. CISA added both CVEs to the Known Exploited Vulnerabilities catalog on October 26, 2026. Cloudflare reported millions of exploitation attempts after disclosure, a researcher reported successful RCE on honeypots, and CYFIRMA suspects (moderate confidence) a North Korea-linked scanning campaign. Unit 42 retracted an earlier claim tying PHP2Shell to a European government agency breach. A third issue, CVE-2026-115560, will be fixed in the regular release cycle

Memory-unsafe code in a runtime behind most of the web, found and weaponized with model assistance faster than the ecosystem could patch