{
  "id": 15897853,
  "title": "PHP2Shell: AI uncovers critical RCE in PHP",
  "url": "https://urgent.news/2026/10/21/php2shell-ai-uncovers-critical-rce-in-php",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-21T13:43:19.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://www.wiz.io/blog/php2shell-php-rce"
  },
  "original_language": "en",
  "account": "Wiz Research reported the discovery of several critical vulnerabilities in PHP, a widely-used scripting language that runs 70% of websites globally. These flaws, present in every PHP version released in the past decade, could lead to unauthorized remote code execution and permit attackers to steal sensitive data or manipulate websites. While human researchers struggled to exploit these issues, frontier AI models significantly facilitated their identification and resolution. The PHP team, Calif, and OpenAI played crucial roles in disclosing and patching these vulnerabilities, which are now categorized under two CVEs with a severity score of up to CVSS 9.2. By combining these vulnerabilities into a single exploit script called php2shell, researchers were able to demonstrate that the issue could be leveraged to execute code remotely on various websites, including WordPress, Drupal, and Joomla.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Techmeme",
        "title": "PHP discloses a critical memory-management vulnerability, dubbed \"PHP2Shell\", that affects up to 70% of websites, discovered using GPT-5.6 Sol in August (Robert McMillan/Wall Street Journal)",
        "url": "https://urgent.news/2026/10/21/php-discloses-a-critical-memory-management-vulnerability-dubbed",
        "published": "2026-10-21T14:06:37.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}