SmackerNews

PHP2Shell: AI uncovers critical RCE in PHP

www.wiz.io/blog/php2shell-php-rce

454 points · 185 comments · 4 days ago · danlark1

wiz.io/blog

https://www.php2shell.com/

fwlr4 days ago
So from what I gather, it was found by OpenAI (via unspecified model?) and independently by Wiz (via Gemini Argon)… but before that it was found by Calif (via unspecified but consumer-available model)… but Calif credit LCFR_HAX before them with first discovery, disclosure, and remediation efforts.
I guess either LCFR or Calif put it in the training data (by using a consumer-available frontier model in the process of discovery or remediation), and then OpenAI reproduced it from the training data, Navier-Stokes-scoop-style? Except I guess more plausibly unaware, and also late? They thought they had something novel, because they weren’t privy to the existing remediation effort? It’s all rather confusing, and then on top there’s a leak and a PR campaign and it just becomes impossible to untangle.
edit: thank you PHP foundation for making this all make sense https://thephp.foundation/blog/2026/10/21/todays-php-securit...
Topfi4 days ago
Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing, especially the month that passed before an acknowledgment.
Edit: Apparently this had been reported more than half a decade ago [0]. I am getting more confused the more I look into this, hopeful for a well written, factual post-mortem from someone who hasn't actively avoided PHP for the last decade.
[0] https://smackernews.com/item/50181395 HN
airtnp4 days ago
Ok, based on my reads on Wiz and Calif writeups, there are 5-6 issues mapped to 2 CVEs.
Wiz (with GPT 5.6 Sol + Gemini 4 Argon) : Remote process-memory disclosure; OPcache type confusion; Fatal-error backtrace UAF. POC on Wordpress, Drupal and Joomla
Calif (with LLM, no specific model, but model is accessible to all): Zend HashTable OOM. Targets PHP-FPM and mod_php.
Both discovers the UAF on upload progress unserializer.
Surprised to see the anime girl dancing with POC is really uploaded by Calif researchers.
edh6494 days ago
Seems to have been prompted from research by calif.io who started disclosure on August 11 vs Wiz on August 24th? A bit unclear on the participants and how they all interacted... https://calif.io/php2shell/
WJW4 days ago
From the related article on calif.io:
We therefore control where PHP places a pointer and its associated type information. This is application-dependent RCE under both Apache mod_php and PHP-FPM.
Both articles describe how you can end up with freed memory that still has pointers into it. I can understand that this should never be possible, but it seems to me that both articles skip the very important step of how to actually turn this into RCE?
From my (admittedly limited) understanding of these things you would not only need to write arbitrary memory, but also need to be able to jump to the relevant address to execute such things. Or do they overwrite the PHP (byte)code with their own and then just let the interpreter do its thing?
jongjong4 days ago
Damn. I've been saying that writing correct software is almost impossible.
I suspect it's a matter of time before all mainstream blockchain projects are cracked. Many of those projects are hundreds of thousands of lines of code. There's no way they don't have vulnerabilities given that AI is now uncovering so many vulnerabilities in such high exposure projects.
I was a code minimalist before, now I'm a radical minimalist. We need to get the lines of code down to the absolute minimum.
Attack surfaces need to be clearly defined, enumerable and testable under all possible conditions.
pettijohn4 days ago
Silly question, is PHP part of Project Glasswing? Crazy this has been dormant for a decade. And scary to wonder what else is lurking out there.
tchalla4 days ago
We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
wildmXranat4 days ago
Did anyone find a reputable source for code which can be used to validate fixes ?
chasil4 days ago
Does active SELinux (as used in Red Hat derivatives) limit the damage at all?
I built some rhel7 systems that are relaying user-provided LDAP credentials into a domain controller, and these are probably wide open with these flaws.
I would hope that SELinux would prevent the launch of a shell, at least.
Does PHP built with FORTIFY_SOURCE and other RedHat-recommended compiler flags help?
ang_cire4 days ago
PHP powers approximately 70% of websites,
Well, that's my depressing statistic for the day...
asbv-1qq4 days ago
The flaw was in at least 20 year old code, which seems to be a common theme for AI discoveries.
No compute costs for finding the issue or for writing the exploit are disclosed.
But it is marketed as if it were the first RCE found in human history.
rbanffy4 days ago
Maybe a silly question, but is there any full-featured CMS suitable for large-ish organizations that's been undefeated in terms of security? The only one that comes to mind is Plone (which is used extensively in the Brazilian government), but there has to be more.
schleck84 days ago
Looking at the technical deep dive further down the article, this is worse than Log4Shell if you need a point of reference. It's one of the two worst exploits that ever publicly surfaced, up there with EternalBlue.
zelphirkalt4 days ago
And just a while ago, I decided against hosting a PHP-based forum service, and instead build my own. Feeling vindicated today.
[deleted]
mg7946134 days ago
I'm so tired of some of these "research setups", do you really need a logo, a brand and everything setup so you can cash in? Was this truely a problem or artificially created?
Especially after fumbling it like this.
"Buy our product, because we found a bug", yeah and you leaked it too.
sehw4 days ago
Ye, no humans but "AI".
ascii0eks844 days ago
To be honest nobody should be surprised. PHP is a wormhole of sorts.. can of worms.
throwaway20373 days ago
Jesus, I just tried to confirm my organ donation wishes at a national org website, and the front page of the website says (roughly): "We are currently down due to a PHP security vulnerability." Truly, this has hit the normies!
1vuio0pswjnm74 days ago
1792509635 | Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming | item?id=50167754 | https://smackernews.com/item/50167754 HN | 0 comments
1792524843 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50171528 HN | 8 comments
1792525762 | Apparent CVSS 10.0 RCE in PHP core [x] | https://twitter.com/cyb3rops/status/2112616479061667936 | https://smackernews.com/item/50171694 HN | 0 comments
1792526855 | Upcoming Critical PHP Security Release Wednesday 21 oct 14:00 UTC | https://www.php.net/archive/2026.php | https://smackernews.com/item/50171937 HN | 0 comments
1792527350 | Upcoming Critical PHP Security Release | https://news-web.php.net/php.announce/509 | https://smackernews.com/item/50172041 HN | 0 comments
1792527832 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50172142 HN | 0 comments
1792528374 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50172253 HN | 0 comments
1792530087 | PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early | https://www.cyberkendra.com/2026/10/php-cve-2026-109618-cve-... | https://smackernews.com/item/50172614 HN | 0 comments
1792531634 | Pure PHP WebRTC+RTMP powering a Telegram webradio | https://twitter.com/DaniilGentili/status/2112635967597150323 | https://smackernews.com/item/50172923 HN | 0 comments
1792533451 | Critical Vulnerabilities in PHP | https://cert.europa.eu/publications/security-advisories/2026... | https://smackernews.com/item/50173247 HN | 1 comment
1792534818 | EU issues RED alert for the critical PHP vulnerability | https://cert.europa.eu/publications/security-advisories/2026... | https://smackernews.com/item/50173483 HN | 0 comments
1792535009 | PHP warns admins of two critical flaws, emergency patches coming tomorrow | https://www.bleepingcomputer.com/news/security/php-warns-adm... | https://smackernews.com/item/50173508 HN | 1 comment
1792536830 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50173797 HN | 0 comments
1792536907 | Upcoming Critical PHP Security Release | https://externals.io/message/132883 | https://smackernews.com/item/50173817 HN | 0 comments
1792537022 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50173836 HN | 0 comments
1792539057 | Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50174131 HN | 0 comments
1792539672 | Upcoming Critical PHP Security Release (CVSSv4 score of 9.2) | https://www.php.net/index.php | https://smackernews.com/item/50174221 HN | 1 comment
1vuio0pswjnm74 days ago
1792584762 | Show HN: Timeminator Self-hosted open-source time tracker (PHP, Docker) | https://github.com/freshNfunky/Timeminator-Community | https://smackernews.com/item/50179595 HN | 1 comment
1792585635 | Governments Take Websites Offline After PHP Security Warnings | https://www.bloomberg.com/news/articles/2026-10-21/governmen... | https://smackernews.com/item/50179760 HN | 1 comment
1792585888 | Dutch National Cyber Security Center is Offline because it uses PHP | https://www.ncsc.nl/actueel | https://smackernews.com/item/50179828 HN | 58 comments
1792586839 | Show HN: Passive exposure check for the PHP2Shell flaws (CVE-2026-109618/109619) | https://php2shell.xyz | https://smackernews.com/item/50179999 HN | 0 comments
1792587855 | Show HN: Managed EmDash CMS hosting on Cloudflare, no PHP, no server | https://hostmyemdash.com/ | https://smackernews.com/item/50180254 HN | 0 comments
1792589908 | Check/probe tool for PHP CVE-2026-109618/619 | https://php2shell.site/news.ycombinator.com/11c22360e8df83b4 | https://smackernews.com/item/50180769 HN | 0 comments
1792589952 | PHP patches have been released | https://www.php.net/archive/2026.php | https://smackernews.com/item/50180783 HN | 0 comments
1792590090 | Simple Proxy to secure your PHP from vulnerability CVE-2026-109618 | https://github.com/Qbix/proxy | https://smackernews.com/item/50180810 HN | 0 comments
1792590108 | PHP Security advisory: Critical remote code execution vulnerabilities | https://www.php.net/archive/2026.php | https://smackernews.com/item/50180818 HN | 0 comments
[deleted]
NooneAtAll34 days ago
Ai fumbles responsible disclosure*
simonw4 days ago
Timeline from that article:
August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
October 21, 2026: Patched PHP releases become available.
October 21, 2026: Public disclosure.
I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?
wren69914 days ago
Did an LLM do the write-up? Half of the "technical deep dive" was just re-stating earlier statements about scope and impact, and I left without a solid grasp of the mechanics of the exploits.
azyc4 days ago
The Wiz post says the root cause is fatal errors (mostly out of memory) leaving corrupted state behind, which "a later request or worker can reuse". So the memory disclosure looks like it depends on the same FPM worker living on into the next request.
Would a low pm.max_requests narrow that part until people can patch? It obviously wouldn't help with the OPcache type confusion, since OPcache is shared memory across workers. airtnp also points out the old-branch backport just disables session upload progress, so session.upload_progress.enabled=0 looks like the cheaper interim knob.
https://www.wiz.io/blog/php2shell-php-rce
eptcyka4 days ago
I guess I should update my nextcloud.
No, scratch that. I should replace it with something that is not a trash fire.
varispeed4 days ago
If AI "uncovered" it, that means it was already in the training data and likely exploited in the wild.

news.ycombinator.com/item?id=50180836

SmackerNews

A placeholder title for loading skeleton

example.com/path/to/article

000 points · username · 0 hours ago

example.com

SmackerNews

PHP2Shell: AI uncovers critical RCE in PHP

www.wiz.io/blog/php2shell-php-rce

454 points · 185 comments · 4 days ago · danlark1

wiz.io/blog

https://www.php2shell.com/

fwlr4 days ago
So from what I gather, it was found by OpenAI (via unspecified model?) and independently by Wiz (via Gemini Argon)… but before that it was found by Calif (via unspecified but consumer-available model)… but Calif credit LCFR_HAX before them with first discovery, disclosure, and remediation efforts.
I guess either LCFR or Calif put it in the training data (by using a consumer-available frontier model in the process of discovery or remediation), and then OpenAI reproduced it from the training data, Navier-Stokes-scoop-style? Except I guess more plausibly unaware, and also late? They thought they had something novel, because they weren’t privy to the existing remediation effort? It’s all rather confusing, and then on top there’s a leak and a PR campaign and it just becomes impossible to untangle.
edit: thank you PHP foundation for making this all make sense https://thephp.foundation/blog/2026/10/21/todays-php-securit...
Topfi4 days ago
Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing, especially the month that passed before an acknowledgment.
Edit: Apparently this had been reported more than half a decade ago [0]. I am getting more confused the more I look into this, hopeful for a well written, factual post-mortem from someone who hasn't actively avoided PHP for the last decade.
[0] https://smackernews.com/item/50181395 HN
airtnp4 days ago
Ok, based on my reads on Wiz and Calif writeups, there are 5-6 issues mapped to 2 CVEs.
Wiz (with GPT 5.6 Sol + Gemini 4 Argon) : Remote process-memory disclosure; OPcache type confusion; Fatal-error backtrace UAF. POC on Wordpress, Drupal and Joomla
Calif (with LLM, no specific model, but model is accessible to all): Zend HashTable OOM. Targets PHP-FPM and mod_php.
Both discovers the UAF on upload progress unserializer.
Surprised to see the anime girl dancing with POC is really uploaded by Calif researchers.
edh6494 days ago
Seems to have been prompted from research by calif.io who started disclosure on August 11 vs Wiz on August 24th? A bit unclear on the participants and how they all interacted... https://calif.io/php2shell/
WJW4 days ago
From the related article on calif.io:
We therefore control where PHP places a pointer and its associated type information. This is application-dependent RCE under both Apache mod_php and PHP-FPM.
Both articles describe how you can end up with freed memory that still has pointers into it. I can understand that this should never be possible, but it seems to me that both articles skip the very important step of how to actually turn this into RCE?
From my (admittedly limited) understanding of these things you would not only need to write arbitrary memory, but also need to be able to jump to the relevant address to execute such things. Or do they overwrite the PHP (byte)code with their own and then just let the interpreter do its thing?
jongjong4 days ago
Damn. I've been saying that writing correct software is almost impossible.
I suspect it's a matter of time before all mainstream blockchain projects are cracked. Many of those projects are hundreds of thousands of lines of code. There's no way they don't have vulnerabilities given that AI is now uncovering so many vulnerabilities in such high exposure projects.
I was a code minimalist before, now I'm a radical minimalist. We need to get the lines of code down to the absolute minimum.
Attack surfaces need to be clearly defined, enumerable and testable under all possible conditions.
pettijohn4 days ago
Silly question, is PHP part of Project Glasswing? Crazy this has been dormant for a decade. And scary to wonder what else is lurking out there.
tchalla4 days ago
We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
wildmXranat4 days ago
Did anyone find a reputable source for code which can be used to validate fixes ?
chasil4 days ago
Does active SELinux (as used in Red Hat derivatives) limit the damage at all?
I built some rhel7 systems that are relaying user-provided LDAP credentials into a domain controller, and these are probably wide open with these flaws.
I would hope that SELinux would prevent the launch of a shell, at least.
Does PHP built with FORTIFY_SOURCE and other RedHat-recommended compiler flags help?
ang_cire4 days ago
PHP powers approximately 70% of websites,
Well, that's my depressing statistic for the day...
asbv-1qq4 days ago
The flaw was in at least 20 year old code, which seems to be a common theme for AI discoveries.
No compute costs for finding the issue or for writing the exploit are disclosed.
But it is marketed as if it were the first RCE found in human history.
rbanffy4 days ago
Maybe a silly question, but is there any full-featured CMS suitable for large-ish organizations that's been undefeated in terms of security? The only one that comes to mind is Plone (which is used extensively in the Brazilian government), but there has to be more.
schleck84 days ago
Looking at the technical deep dive further down the article, this is worse than Log4Shell if you need a point of reference. It's one of the two worst exploits that ever publicly surfaced, up there with EternalBlue.
zelphirkalt4 days ago
And just a while ago, I decided against hosting a PHP-based forum service, and instead build my own. Feeling vindicated today.
[deleted]
mg7946134 days ago
I'm so tired of some of these "research setups", do you really need a logo, a brand and everything setup so you can cash in? Was this truely a problem or artificially created?
Especially after fumbling it like this.
"Buy our product, because we found a bug", yeah and you leaked it too.
sehw4 days ago
Ye, no humans but "AI".
ascii0eks844 days ago
To be honest nobody should be surprised. PHP is a wormhole of sorts.. can of worms.
throwaway20373 days ago
Jesus, I just tried to confirm my organ donation wishes at a national org website, and the front page of the website says (roughly): "We are currently down due to a PHP security vulnerability." Truly, this has hit the normies!
1vuio0pswjnm74 days ago
1792509635 | Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming | item?id=50167754 | https://smackernews.com/item/50167754 HN | 0 comments
1792524843 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50171528 HN | 8 comments
1792525762 | Apparent CVSS 10.0 RCE in PHP core [x] | https://twitter.com/cyb3rops/status/2112616479061667936 | https://smackernews.com/item/50171694 HN | 0 comments
1792526855 | Upcoming Critical PHP Security Release Wednesday 21 oct 14:00 UTC | https://www.php.net/archive/2026.php | https://smackernews.com/item/50171937 HN | 0 comments
1792527350 | Upcoming Critical PHP Security Release | https://news-web.php.net/php.announce/509 | https://smackernews.com/item/50172041 HN | 0 comments
1792527832 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50172142 HN | 0 comments
1792528374 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50172253 HN | 0 comments
1792530087 | PHP RCE Zero-Days CVE-2026-109618, CVE-2026-109619 Leak Early | https://www.cyberkendra.com/2026/10/php-cve-2026-109618-cve-... | https://smackernews.com/item/50172614 HN | 0 comments
1792531634 | Pure PHP WebRTC+RTMP powering a Telegram webradio | https://twitter.com/DaniilGentili/status/2112635967597150323 | https://smackernews.com/item/50172923 HN | 0 comments
1792533451 | Critical Vulnerabilities in PHP | https://cert.europa.eu/publications/security-advisories/2026... | https://smackernews.com/item/50173247 HN | 1 comment
1792534818 | EU issues RED alert for the critical PHP vulnerability | https://cert.europa.eu/publications/security-advisories/2026... | https://smackernews.com/item/50173483 HN | 0 comments
1792535009 | PHP warns admins of two critical flaws, emergency patches coming tomorrow | https://www.bleepingcomputer.com/news/security/php-warns-adm... | https://smackernews.com/item/50173508 HN | 1 comment
1792536830 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50173797 HN | 0 comments
1792536907 | Upcoming Critical PHP Security Release | https://externals.io/message/132883 | https://smackernews.com/item/50173817 HN | 0 comments
1792537022 | Upcoming Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50173836 HN | 0 comments
1792539057 | Critical PHP Security Release | https://www.php.net/archive/2026.php | https://smackernews.com/item/50174131 HN | 0 comments
1792539672 | Upcoming Critical PHP Security Release (CVSSv4 score of 9.2) | https://www.php.net/index.php | https://smackernews.com/item/50174221 HN | 1 comment
1vuio0pswjnm74 days ago
1792584762 | Show HN: Timeminator Self-hosted open-source time tracker (PHP, Docker) | https://github.com/freshNfunky/Timeminator-Community | https://smackernews.com/item/50179595 HN | 1 comment
1792585635 | Governments Take Websites Offline After PHP Security Warnings | https://www.bloomberg.com/news/articles/2026-10-21/governmen... | https://smackernews.com/item/50179760 HN | 1 comment
1792585888 | Dutch National Cyber Security Center is Offline because it uses PHP | https://www.ncsc.nl/actueel | https://smackernews.com/item/50179828 HN | 58 comments
1792586839 | Show HN: Passive exposure check for the PHP2Shell flaws (CVE-2026-109618/109619) | https://php2shell.xyz | https://smackernews.com/item/50179999 HN | 0 comments
1792587855 | Show HN: Managed EmDash CMS hosting on Cloudflare, no PHP, no server | https://hostmyemdash.com/ | https://smackernews.com/item/50180254 HN | 0 comments
1792589908 | Check/probe tool for PHP CVE-2026-109618/619 | https://php2shell.site/news.ycombinator.com/11c22360e8df83b4 | https://smackernews.com/item/50180769 HN | 0 comments
1792589952 | PHP patches have been released | https://www.php.net/archive/2026.php | https://smackernews.com/item/50180783 HN | 0 comments
1792590090 | Simple Proxy to secure your PHP from vulnerability CVE-2026-109618 | https://github.com/Qbix/proxy | https://smackernews.com/item/50180810 HN | 0 comments
1792590108 | PHP Security advisory: Critical remote code execution vulnerabilities | https://www.php.net/archive/2026.php | https://smackernews.com/item/50180818 HN | 0 comments
[deleted]
NooneAtAll34 days ago
Ai fumbles responsible disclosure*
simonw4 days ago
Timeline from that article:
August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
October 21, 2026: Patched PHP releases become available.
October 21, 2026: Public disclosure.
I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?
wren69914 days ago
Did an LLM do the write-up? Half of the "technical deep dive" was just re-stating earlier statements about scope and impact, and I left without a solid grasp of the mechanics of the exploits.
azyc4 days ago
The Wiz post says the root cause is fatal errors (mostly out of memory) leaving corrupted state behind, which "a later request or worker can reuse". So the memory disclosure looks like it depends on the same FPM worker living on into the next request.
Would a low pm.max_requests narrow that part until people can patch? It obviously wouldn't help with the OPcache type confusion, since OPcache is shared memory across workers. airtnp also points out the old-branch backport just disables session upload progress, so session.upload_progress.enabled=0 looks like the cheaper interim knob.
https://www.wiz.io/blog/php2shell-php-rce
eptcyka4 days ago
I guess I should update my nextcloud.
No, scratch that. I should replace it with something that is not a trash fire.
varispeed4 days ago
If AI "uncovered" it, that means it was already in the training data and likely exploited in the wild.

news.ycombinator.com/item?id=50180836