AI helped find PHP2Shell, two critical flaws in the code behind most websites

Two critical vulnerabilities in PHP, collectively called PHP2Shell, were disclosed on Wednesday. Both score 9.2 out of 10 on the CVSS v4.0 severity scale. PHP powers roughly 70% of websites, so a flaw in its core engine reaches far beyond any single app. PHP shipped patches the same day the details went public.

Security firm Wiz says attackers can use the flaws to run code on WordPress, Drupal and Joomla sites without logging in. At least one flaw affects every PHP release from the past decade. The bugs are memory-safety problems: after a request runs out of memory or crashes, PHP can leave behind references to memory that was already freed, and the next request handled by the same worker process may still treat them as valid.

AI played a central role in finding them. Calif found one using OpenAI's GPT-5.6 Sol. Wiz says it independently found both using Google's Gemini 4 Argon and GPT-5.6 Sol. Wiz says one researcher did in about a week what once took a team months.

The rollout was messy. The details leaked about nine hours early, and Cloudflare says it saw attack traffic before the announcement. Some European government and hospital sites went offline as a precaution. The PHP Foundation called patching imperative and said any PHP installation serving web requests is at risk.

Our take

The bugs sat hidden for a decade, and a researcher with a frontier model found them in days. Attackers can rent the same tools, so patch windows measured in weeks now look too slow.