Wiz finds critical PHP RCE flaws affecting 70% of web servers

Wiz Research uncovered multiple critical vulnerabilities in the core PHP engine that allow unauthenticated remote code execution. These flaws enable attackers to take control of servers and steal sensitive data, impacting roughly 70% of all websites globally, according to the firm's findings published recently.

The vulnerabilities are inherent in the PHP language itself rather than in application code. This means websites using secure application logic remain at immediate risk if they run affected PHP versions. Attackers can exploit these issues remotely to execute arbitrary code or read process memory containing passwords and API keys.

AI-Driven Discovery and Severity

The research team grouped the findings under two CVEs with severity scores reaching CVSS 9.2. While the underlying flaws had existed for decades, demonstrating their exploitability required complex chaining of steps that previously exceeded practical human limits. Frontier AI models substantially reduced this barrier, allowing the researchers to develop and adapt working exploits across multiple applications in hours.

Wiz stated that AI helped uncover these vulnerabilities that had remained hidden in the PHP codebase for more than a decade. The work required adapting to each target's memory layout through repeated testing and debugging, a process made practical by the efficiency of frontier AI models. This illustrates how AI can change the practical exploitability of longstanding vulnerabilities.

Affected Versions and Timeline

Every PHP version released in the last decade is affected by at least one of these vulnerabilities. This includes releases dating back to version 5.4. The PHP team released a patch fixing these multiple memory-safety vulnerabilities on October 21, 2026. Immediate patching is strongly advised for all administrators running these older versions.

PHP powers major web platforms including WordPress, Joomla, Drupal, and Wikipedia’s MediaWiki. Because the flaws are in the core engine, a vulnerability in PHP affects websites across this entire ecosystem. Even if the specific application code is secure, the underlying language flaw exposes the server to unauthorized access and data theft.

What should you do?

Organizations should verify their PHP versions immediately against the list of affected releases. If running a version from 5.4 up to the patched release, administrators must apply the update provided on October 21, 2026. Monitoring server logs for unusual activity is also recommended to detect potential exploitation attempts before full control is gained.

What to do and how to stay safe: PHP

• Inventory all servers running PHP and identify the specific version installed on each system.
• Apply the security patch released on October 21, 2026, to update the PHP core engine.
• Monitor server access logs for signs of unauthorized remote code execution attempts.
• Rotate sensitive credentials such as API keys and authentication tokens if exposure is suspected.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by these vulnerabilities?

Every PHP version released in the last decade is affected, including releases dating back to version 5.4.

When was the patch for these vulnerabilities released?

The PHP team released a patch fixing the memory-safety vulnerabilities on October 21, 2026.

How did AI contribute to discovering these flaws?

Frontier AI models reduced the complexity barrier, enabling researchers to chain multiple flaws and develop working exploits in hours.