Wiz says it used AI to find 'PHP2Shell', a critical remote code execution flaw in PHP (via community)

Verified (fact)

Security company Wiz disclosed 'PHP2Shell', a critical remote code execution (RCE) vulnerability in PHP, on its blog. It reportedly found the flaw using AI. The post drew attention on Hacker News with 182 points and 46 comments. The collected information does not include affected versions, a CVE number, or patch status.

Needs fact-check (claim)

Wiz claimed the vulnerability was found by AI.

Why it matters (interpretation)

PHP is widely deployed on web servers, so an RCE flaw could have broad impact. Anyone running services on PHP should check the original post right away for affected versions and patch guidance. It also reflects a continuing rise in cases of AI finding serious vulnerabilities in critical open-source infrastructure.

Sources

• Community PHP2Shell: AI uncovers critical RCE in PHP Hacker News

Story thread

1. 2026-10-21 Wiz says it used AI to find 'PHP2Shell', a critical remote code execution flaw in PHP (via community)
2. 2026-10-21 PHP2Shell follow-up: Emergency patch for two RCE flaws across all PHP 8.x versions; exploits spread first after coordinated disclosure leaked (community reports)
3. 2026-10-22 PHP remote code execution flaw follow-up: Korea's science ministry and KISA raise private-sector cyber alert from 'Attention' to 'Caution' (report)

More about Wiz

• 2026-10-21 P1 Open source Generally available AI security PHP FoundationWizOpenAI
  PHP2Shell follow-up: Emergency patch for two RCE flaws across all PHP 8.x versions; exploits spread first after coordinated disclosure leaked (community reports)

  According to a post by Simon Willison highlighting a PHP Foundation announcement, a security update has been released fixing two remote...