AI finds critical remote code execution flaw in PHP

By Splitfeed EditorialLast updated Oct 21, 2026, 19:20 UTC

On October 21, 2026, security firm Wiz published research describing a cluster of critical remote code execution vulnerabilities in PHP, which the company says underlies approximately 70 percent of the internet. Wiz attributed the discovery to an AI system and gave the vulnerability set the name PHP2Shell. The findings appeared on Wiz's own site and were picked up the same day by general-audience outlets including CNN and Fortune.

The significance of a remotely exploitable code execution flaw in PHP is difficult to overstate in practical terms. PHP runs a large share of web servers and content management systems worldwide, meaning that a working exploit could theoretically give an attacker arbitrary control over an enormous number of sites and services. What remains unresolved at this stage is the patch status: no CVE identifiers have been assigned in the available information, and no statement from the PHP project itself has surfaced. Until a patch is confirmed and deployed, the gap between disclosure and remediation is the most consequential open question.

Because no published reactions from the Pro-AI, Anti-AI, or Middle Ground camps are available yet, what each would typically argue can only be anticipated. The Pro-AI camp would likely treat this as a concrete demonstration of AI's ability to find high-stakes vulnerabilities faster than conventional auditing, pointing to the scale of the affected infrastructure as evidence of real-world value. The Anti-AI camp would probably raise questions about responsible disclosure, arguing that publicizing a flaw affecting 70 percent of the internet before a patch exists could hand attackers a roadmap. The Middle Ground camp would characteristically separate the discovery itself, which it would credit as genuinely useful, from the disclosure process, urging caution about how AI-assisted security research is released publicly. These are expected positions, not statements anyone has made.

The details to watch are a CVE assignment from MITRE, an official response or patch timeline from the PHP project, and any indication from Wiz about coordinated disclosure arrangements. Those steps would clarify both the technical severity of PHP2Shell and whether the disclosure process followed established security norms.