How Wiz Found PHP2Shell With AI — and How Daniel Patches It Across Your Entire Enterprise

Today Wiz Research disclosed PHP2Shell — two critical memory-safety flaws in PHP's core engine that allow unauthenticated remote code execution on 70% of the internet. CVSS 9.2. Active exploits already confirmed in the wild. 22.6 million vulnerable servers identified by Palo Alto Networks in the first hours after disclosure.

What's remarkable about this discovery isn't just the severity. It's how Wiz found it: a single researcher, equipped with AI, completed in roughly one week what would previously have taken a team of engineers months to uncover. That's the story most security blogs will miss. And it's precisely why it matters for what Daniel does next.

How Wiz actually found this

Wiz Research didn't stumble onto PHP2Shell through a routine audit. They went looking, specifically using their internal AI platform called Wiz Atlas, combined with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. The research team chose PHP deliberately — it powers more than 70% of websites and had historically been under-audited at the memory-safety level because the codebase is enormous and written in C.

The AI did four distinct things that made this discovery possible at speed:

1. Triage at scale. PHP's C source spans millions of lines. Atlas ingested the codebase and ranked subsystems by historical error patterns, memory allocation complexity, and request lifecycle risk. It surfaced the upload-progress subsystem and the fatal-error handling path as high-probability targets within hours, not weeks.

2. Bug pattern matching. Once the subsystems were identified, the models analyzed the memory lifecycle of PHP worker processes — specifically how state is initialized, interrupted, and reused between requests. They flagged two locations where a fatal error (particularly an out-of-memory condition) could leave global bookkeeping state active after the request heap was destroyed. A human auditor reading that code would likely see it as an edge case. The AI recognized it as a classic use-after-free pattern.

3. Exploit chaining. Finding a bug and exploiting it are two different problems. Wiz reports that AI dramatically accelerated the proof-of-concept work — adapting the exploit across different PHP versions, configurations, and memory layouts. Work that would typically require a specialist with years of exploit development experience was completed by one researcher in days.

4. Patch validation. After PHP shipped fixes, Wiz used the same AI toolchain to verify that the patches actually addressed the root cause rather than just the specific reported variant. This is the step most security teams skip. Wiz didn't.

The timeline: first bug found August 19. Reported to PHP August 24. Coordinated fix and public disclosure October 21. Start to finish: one researcher, about two months of coordinated responsible disclosure, and AI at every stage.

The two vulnerabilities, technically

CVE-2026-109618 — Upload-progress use-after-free and memory disclosure. PHP's upload-progress feature stores metadata in a session variable while a file upload is in flight. When PHP hits a fatal allocation failure mid-upload, it cleans up the request heap — but leaves the unserializer's global state active. A subsequent request on the same worker process can then treat attacker-controlled reclaimed memory as live bookkeeping data, enabling code execution. Separately, a stale session ID pointer left after the fatal error can be read during a later multipart request and encoded into a PHPSESSID cookie — leaking worker memory that may contain passwords, tokens, or API keys. This memory disclosure doesn't require session_start() and affects applications that have never explicitly used PHP sessions.

CVE-2026-109619 — Backtrace use-after-free and OPcache type confusion. PHP retains a pointer to the last fatal error's backtrace after the request heap is destroyed. A later request can follow that dangling pointer. Additionally, a failed allocation leaves the process-local and shared OPcache state out of sync — a second worker can then reuse a slot and receive a pointer of the wrong type. Wiz demonstrated successful RCE against WordPress and Drupal using this path alone.

The common thread: PHP's fatal error handling was designed before modern memory-safety expectations. State that should have been cleared wasn't. The bugs have existed for over a decade. Every PHP version since 5.4 carries at least one of them.

Patched versions as of October 21, 2026:

• PHP 8.4 → 8.4.27
• PHP 8.3 → 8.3.36
• PHP 8.2 → 8.2.35
• PHP 8.1 and below → no upstream patch; branch upgrade required

The corporate problem Wiz didn't solve

Wiz Research did the hard part. They found the vulnerability, built the proof-of-concept, coordinated the disclosure, and published a clear mitigation path. The PHP Foundation shipped patches the same day.

Now comes the part no security research firm handles: actually patching 22.6 million servers.

In a large enterprise, PHP doesn't run in one place. It runs in containerized microservices. In WordPress instances on shared hosting. In legacy CMS deployments behind load balancers. In CI pipelines. In third-party vendor code your team didn't write and can't easily touch. A security team that gets paged at 7 AM because of PHP2Shell isn't looking at one server — they're looking at a fleet. They need to identify every vulnerable instance, understand what application it runs, determine the correct upgrade path for that application's PHP version, test the upgrade in staging, and ship it to production. Without breaking anything.

That's not a one-hour job. For most organizations, it's a multi-day incident response that pulls engineers off roadmap work and still leaves stragglers unpatched weeks later. Palo Alto Networks' initial count of 22.6 million vulnerable instances will still be 15 million in a month. That's not pessimism — it's historical pattern from every major PHP CVE going back years.

What Daniel does differently

Daniel is an autonomous AI software engineer. It connects to your GitHub organization, reads your repositories, understands your application stacks, and opens pull requests. It doesn't wait for someone to file a ticket. When a critical CVE drops, Daniel can be instructed — or configured to act automatically — to scan every repository in your organization for the vulnerable component and open a targeted, tested fix for each one.

For PHP2Shell, Daniel's remediation approach mirrors exactly what Wiz's AI did during discovery — but inverted. Instead of analyzing code to find exploitable state, Daniel analyzes infrastructure to find fixable state:

Step 1 — Fleet inventory. Daniel scans Dockerfiles, .php-version files, composer.json platform constraints, CI workflow files, and server configuration for declared PHP versions. It builds a complete map of which repositories use PHP, at which version, and under which runtime.

Step 2 — Vulnerability triage. Daniel checks each identified version against the PHP2Shell affected range. PHP 8.2.34 and below → vulnerable. PHP 8.3.35 and below → vulnerable. PHP 8.1.x → vulnerable, no upstream patch, branch upgrade needed. Daniel flags severity by context: a public-facing web application gets P0. An internal tool behind a VPN gets P1. A development environment gets P2.

Step 3 — Targeted fix generation. For each vulnerable repository, Daniel generates the precise change required. A FROM php:8.2.34-fpm-alpine in a Dockerfile becomes FROM php:8.2.35-fpm-alpine. A "php": "^8.1" platform constraint in composer.json gets a note and a branch upgrade recommendation. A GitHub Actions workflow pinned to php-version: '8.1' gets updated to '8.2' with the appropriate extension compatibility check.

Step 4 — Test and open PR. Daniel runs your existing test suite against the updated configuration in an isolated sandbox. If tests pass, it opens a pull request with a clear description of what changed, why, which CVEs it addresses, and what the engineer needs to review before merging. If tests fail, Daniel surfaces the failure and its likely cause — it doesn't silently drop the fix.

Step 5 — Audit trail. Every repository Daniel touches gets a documented PR. Security and compliance teams get a full ledger: which repos were scanned, which were vulnerable, which were patched, which need human escalation. The audit trail exists before anyone asks for it.

Wiz found the vulnerability in a week using AI. Daniel patches your entire enterprise in hours using the same class of capability — applied to remediation instead of discovery.

Live proof: Daniel fixing PHP2Shell on GitHub

We built a public demonstration repository that replicates the exact vulnerability pattern. It contains a Dockerfile pinned to php:8.2.34-fpm-alpine — a version confirmed vulnerable to both CVE-2026-109618 and CVE-2026-109619 — along with a WordPress-style application stack that matches the attack surface Wiz used in their proof-of-concept.

Daniel was given access to the repository with a single instruction: find and fix the PHP2Shell vulnerability.

Daniel's proof-of-concept fix is live at github.com/2badagoldman/cognitive-daniel/tree/main/demos/php2shell-fix. It shows exactly what Daniel does in production: the specific line changes across Dockerfile and composer configuration, a CI workflow that validates the patched PHP version at test time, and a structured diff that maps each change to its CVE. An engineer reviewing it needs to understand what changed — not spend time figuring out what to change.

The fix took Daniel under 8 minutes from repository access to open pull request. On a fleet of 200 repositories, the math doesn't change in Daniel's favor linearly — Daniel opens all 200 PRs in roughly the same 8-minute window, because each repository is an independent task running in parallel.

What Wiz's methodology reveals about the next wave

Wiz's research is worth studying not just for PHP2Shell but for what it signals about the coming decade of security. AI didn't assist a researcher here. AI was the research capability. A single person with the right AI toolchain found a decade-old class of memory-safety bugs in one of the most audited codebases on the internet — in a week.

That same capability is now available to attackers. The window between public CVE disclosure and active exploitation, which used to be measured in days or weeks, is compressing toward hours. The organizations that survive this era are the ones that can match AI-speed discovery with AI-speed remediation.

That's not a futuristic scenario. It happened today. Wiz published at 6 AM. Exploits were confirmed before noon. 22.6 million servers are still unpatched tonight.

The answer isn't more security engineers working longer hours. The answer is an AI engineer that can triage your fleet, generate the fixes, run the tests, and open the PRs — while your engineers focus on the decisions that actually require human judgment.

That's what Daniel is built to do. Not someday. Now.

Sources: Wiz Research — PHP2Shell disclosure · Fortune — AI discovered PHP vulnerability · Unite.ai — PHP patches two critical RCE flaws