cybersecurity firm Wiz said
Cybersecurity firm Wiz Research has identified multiple critical vulnerabilities in core PHP, a widely-used scripting language powering 70% of all websites globally. Successful exploitation could enable attackers to take control of affected servers, steal sensitive data, and deface websites. These vulnerabilities, including memory disclosure and unauthenticated remote code execution, affect every PHP version released in the last decade, dating back to version 5.4.
On October 21, 2026, PHP addressed the issue with a patch. This ranks as one of the most severe vulnerabilities in PHP's history, with underlying flaws present for decades but recently discovered using advanced AI techniques. By leveraging frontier AI models, Wiz Research was able to identify and address these long-standing issues, which stem from key architecture decisions made over a decade ago.
The vulnerabilities allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, potentially exposing passwords, authentication tokens, API keys, and certificates. PHP, the backbone of many popular platforms like WordPress, Drupal, and Wikipedia's MediaWiki, poses a significant risk to the web ecosystem.
The exploitation process required chaining multiple flaws and adapting to each target's memory layout. The vulnerabilities are memory-safety issues that arise from bugs in how PHP handles fatal errors during request processing. The PHP team, along with various other companies, has provided guidance and mitigations for customers who cannot immediately apply the patch.
Written by urgent.news from Rest of World's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
