AI-Assisted Research Uncovers Critical PHP2Shell RCE Vulnerabilities

Frontier AI models have identified two critical remote code execution (RCE) vulnerabilities in the PHP language runtime that remained undetected through a decade of manual security audits. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code on servers running affected versions of PHP. AI-assisted analysis identified these memory-corruption flaws, which had remained hidden in the PHP codebase for more than a decade. The Mechanism of PHP2Shell Wiz Research , which combined these vulnerabilities into an exploit script dubbed “php2shell,” identified the flaws as memory-safety issues stemming from how PHP handles fatal errors during request processing. CVE-2026-109618 involves out-of-memory (OOM) corruption, where PHP interrupts a request while internal data is only partially initialized.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.