CoolingSafety
Wiz Research finds PHP engine memory flaws, including unauthenticated RCE, with AI models; patches out
Wiz says it found memory-safety bugs in PHP's core engine, grouped under CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2 and unauthenticated remote code execution. Wiz says every PHP release back to 5.4 has at least one. It used Gemini 4 Argon and GPT-5.6 Sol. PHP shipped patched versions Oct. 21.
- HEAT
- OUTLETS
- 1
- HACKER NEWS
- 395 pts
- FIRST SEEN
- LAST SIGNAL
Primary source
Wizwiz.io/blog/php2shell-php-rceCoverage · 1 article, oldest first
Wednesday, October 21, 2026
wiz.io395 pts on HN
PHP2Shell: AI uncovers critical RCE in PHP