Critical Core Vulnerabilities Found in PHP Affecting Most Websites

The digital infrastructure supporting vast portions of the global web faces an immediate and severe threat following the discovery of multiple critical vulnerabilities within core PHP. Wiz Research has uncovered deep-seated memory-safety flaws in the popular general-purpose scripting language, a system that powers an estimated 70% of all websites worldwide. Successful exploitation of these weaknesses could grant attackers unauthorized control over affected servers, allowing them to steal highly sensitive data, deface operational websites, or execute malicious code remotely.

PHP is not merely a component; it is the foundational backbone for some of the world's most widely used platforms. It powers massive content management systems like WordPress, Joomla, and Drupal, as well as major archival sites such as Wikipedia’s MediaWiki. Because these vulnerabilities reside in the core engine itself—independent of any specific application code running on top—a flaw can compromise entire ecosystems of websites, even if those sites have diligently secured their own custom applications.

The nature of the vulnerability is deeply technical: it involves memory disclosure and unauthenticated remote code execution (RCE) flaws. These issues stem from how PHP handles fatal errors, particularly when processing out-of-memory conditions. When a request ends unexpectedly due to such an error, the internal PHP state can become corrupted or 'stale.' A subsequent worker or request reusing this compromised state can lead directly to memory corruption or disclosure of sensitive process data.

This systemic flaw is extremely broad in scope. Nearly every version of PHP released over the last decade is affected by at least one of these issues, with vulnerabilities tracing back all the way to version 5.4. The severity is underscored by a CVSS score reaching 9.2. While underlying flaws have existed for years, demonstrating their practical exploitability required an exceptionally complex chain of steps. It was this challenge that made the discovery so significant: frontier AI models were critical in substantially reducing the barrier to entry, turning long-standing theoretical flaws into practical, working exploits.

This breakthrough highlights a major shift in cybersecurity risk. As the time and expertise needed for exploitation decrease due to advanced tools like AI, complexity can no longer serve as a meaningful security barrier. This situation is being compared by experts to historical moments like Heartbleed or Log4Shell, marking PHP2Shell as potentially a turning point that illustrates how artificial intelligence changes the practical exploitability of deeply embedded software flaws.

The solution and mitigation guidance have been extensive. The PHP team released the necessary patch on October 21, 2026, fixing multiple memory-safety vulnerabilities at their core. However, due to the critical nature of these issues, a massive cross-industry effort was required. Organizations including AWS, Cloudflare, Fastly, Google, Microsoft, and many others collaborated to prepare guidance and out-of-the-box mitigations for customers who could not apply the patch immediately.

For website administrators and developers, the takeaway is clear: immediate patching of PHP is strongly advised. The vulnerabilities can allow unauthenticated attackers to execute code or read process memory that may contain highly sensitive information—including passwords, authentication tokens, API keys, and certificates belonging to other users or the server itself. While specific demonstrations were run against container images for WordPress, Drupal, and Joomla, the underlying flaw resides in PHP’s core engine, making it a universal risk across all deployments.

The severity of this issue demands that system administrators treat patching as an absolute priority. The patch provided by the dedicated PHP team is comprehensive, fixing the issue at its root cause and eliminating all known variants. Given that PHP powers such a massive percentage of global web traffic, vigilance and rapid deployment of security updates are paramount to protecting user data and maintaining the integrity of the internet's core infrastructure.