AI Research
Oct 21, 2026
Critical vulnerabilities found in PHP could allow remote code execution
Oct 21, 2026
AI Summary
Wiz Research identified multiple severe vulnerabilities in PHP, a widely-used scripting language that powers a significant portion of the web. These vulnerabilities could enable attackers to execute code remotely and access sensitive data across various applications, necessitating immediate patching by users.
- Wiz Research discovered critical vulnerabilities in PHP, affecting all versions released in the last decade, including those dating back to version 5.4.
- The vulnerabilities allow unauthenticated remote code execution and memory disclosure, posing risks to servers and sensitive data.
- PHP is integral to numerous applications, including WordPress, Joomla, and Drupal, meaning the impact of these vulnerabilities is widespread.
- The vulnerabilities stem from memory-safety issues related to how PHP handles fatal errors, particularly out-of-memory errors.
- A patch was released on October 21, 2026, to address these vulnerabilities, which have been present for over a decade.
- The vulnerabilities were grouped under two CVEs with a severity rating of CVSS 9.2, indicating their critical nature.
- AI models significantly aided in discovering and exploiting these vulnerabilities, changing the landscape of vulnerability exploitation.
- The vulnerabilities can lead to unauthorized access to sensitive information such as passwords and API keys, even without executing code.
- Organizations are advised to apply the patch immediately and monitor for unusual request patterns as a temporary measure until updates can be implemented.
rcephpaisecurityvulnerability