Two critical security flaws had been hiding in PHP for more than a decade. Wiz researchers revealed the vulnerabilities after working with OpenAI and PHP’s security team to prepare emergency fixes.
PHP powers around 70% of websites, including platforms like WordPress and Drupal. The flaws, nicknamed PHP2Shell, could let attackers take control of vulnerable servers or access sensitive information.
- Both vulnerabilities received a critical severity score of 9.2 out of 10.
- Researchers used Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol, and Wiz Atlas to uncover and investigate the flaws.
- The coordinated disclosure gave PHP maintainers time to develop security patches before the vulnerabilities became public.
- Website operators running affected PHP versions are being urged to update immediately, as there is no complete workaround.
The discovery shows how AI is changing cybersecurity, helping researchers uncover hidden threats faster while potentially giving attackers access to similar capabilities.
