PHP patches two critical core-engine flaws found with frontier models

Fri, 23 Oct 2026 16:04:55 GMT

PHP released security updates for two critical core-engine vulnerability groups that can enable unauthenticated remote code execution or process-memory disclosure. Wiz reports that frontier models helped researchers turn long-standing memory-safety flaws into working exploits across representative WordPress, Drupal and Joomla deployments. The flaws are in PHP itself; affected servers need patched PHP releases.

Why read: Critical PHP core fixes are available, while AI-assisted exploit development changes both immediate patch priority and attack economics.

Recommendation: ADOPT

Sources: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · PHP security releases for two critical vulnerabilities · Coordinated disclosure of critical vulnerabilities

MATRIX · PHP2Shell

PHP patches two critical core-engine flaws found with frontier models