Introduction
Artificial intelligence is changing the way cybersecurity researchers identify weaknesses in software. A recent case involving PHP2Shell, a group of critical vulnerabilities in the widely used PHP programming language, highlights how AI tools can help researchers investigate complex security flaws that may have remained hidden for years.
Disclosed on October 21, 2026, PHP2Shell involves two vulnerabilities that can potentially allow attackers to execute malicious code on affected servers without logging in. The flaws affect PHP itself, meaning websites can be at risk even when their own application code does not contain the underlying bug.
The discovery was not the work of an AI system acting entirely alone. It involved cybersecurity researchers, AI models, software maintainers, and technology companies working together to investigate the vulnerabilities, verify their impact, and prepare security updates. According to Wiz Research’s technical report, AI played an important role in making complex exploit development more practical.
What Is PHP2Shell?
PHP is a server-side programming language used to build dynamic websites and web applications. It is a core technology behind popular platforms and content management systems, including WordPress, Drupal, and Joomla.
PHP2Shell is the name used for a group of related PHP security vulnerabilities and the exploit research that demonstrated their potential impact. The issues were assigned two identifiers: CVE-2026-109618 and CVE-2026-109619.
According to the official PHP security advisory, the vulnerabilities involve problems with memory handling when PHP processes requests that end in fatal errors, including out-of-memory conditions.
Under certain circumstances, PHP may retain or reuse invalid internal state after a request fails. This can lead to memory corruption and, in demonstrated cases, remote code execution.
Remote code execution is a serious security risk because it may allow an attacker to run commands or malicious code on a vulnerable server. Depending on the system and the attacker’s access, the consequences could include data theft, website defacement, or further compromise of the server.
The PHP security team released fixes for supported versions on October 21, 2026, and urged users to update promptly.
Who Discovered PHP2Shell: Humans or AI?
The most accurate answer is that human cybersecurity researchers and AI systems worked together.
Wiz Research publicly documented the vulnerabilities and described how AI models helped its team investigate the flaws and develop working exploits. The company credited its research team, including Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz, for the work.
Wiz reported that its researchers used several AI technologies, including Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. According to the company’s account, these models helped with discovery, exploit development, testing, and adapting exploits to different software environments.
The research also involved collaboration with Calif, OpenAI, and the PHP security team. Their contributions included investigation, coordination, and verification of the fixes before public disclosure.
It is important to distinguish between identifying a potential flaw and confirming that it can be exploited. AI can suggest promising attack paths or help analyze complicated code, but researchers still need to test findings, establish their real-world impact, and work with software maintainers to address the problem.
For further details, read the Wiz Research PHP2Shell investigation and the official PHP security announcement.
How Did AI Help Researchers Find the Vulnerabilities?
Software security research can involve examining large codebases, understanding how internal components interact, and testing unusual situations that may cause unexpected behavior.
Some vulnerabilities are relatively easy to identify. Others require several separate weaknesses to be combined into a reliable attack. This second category can demand extensive programming knowledge, repeated experiments, and detailed debugging.
In the PHP2Shell investigation, researchers reported that AI models helped make this complex process more practical.
1. Analyzing Complex Code
AI models can help researchers examine source code, trace how information moves through a program, and identify areas where memory may be handled incorrectly.
This does not mean that an AI model automatically understands every bug or always reaches the correct conclusion. Rather, it can help experts explore code paths and generate hypotheses that can then be tested.
2. Connecting Multiple Weaknesses
A single software flaw may not always be enough to compromise a server. In some cases, an attacker must combine several weaknesses to achieve a more serious result.
Wiz reported that developing the PHP2Shell exploit required chaining multiple flaws and adapting the approach to different memory layouts. AI-assisted analysis and repeated testing helped researchers make this process faster and more practical.
3. Testing and Refining Exploits
Researchers must determine whether a suspected vulnerability is reproducible and whether it produces the claimed result.
AI can assist with debugging, generating test variations, and refining technical approaches. Human experts remain essential for checking the evidence, understanding limitations, and ensuring that the findings are reported responsibly.
4. Helping Verify Security Fixes
Discovering a vulnerability is only part of the process. Developers must also identify the underlying cause and ensure that a proposed fix addresses it without introducing new problems.
The PHP security team worked on patches before the vulnerabilities were publicly disclosed. Coordinated testing and verification helped prepare updates for affected versions.
Why Is This Discovery Important?
PHP is widely used across the web. A vulnerability in its core engine can therefore have a broader impact than a flaw limited to a single website or plugin.
Wiz reported that the PHP2Shell vulnerabilities could affect a wide range of applications using vulnerable PHP versions, including WordPress, Drupal, and Joomla. The researchers demonstrated remote code execution in test deployments of these platforms.
This does not mean that every website using these systems has been compromised. The actual risk depends on factors such as the PHP version, server configuration, and whether the vulnerable code paths are present and reachable.
Nevertheless, PHP2Shell demonstrates why security flaws in widely shared software components deserve urgent attention. A weakness in a foundational technology can affect many independently operated websites and services.
The case also highlights a significant development in cybersecurity: AI may lower the amount of time and specialized effort required to investigate complicated vulnerabilities.
That could help defenders discover and repair more weaknesses. At the same time, the same capabilities could make it easier for malicious actors to develop attacks against systems that have not yet been updated.
The Risks of AI-Powered Cybersecurity
AI-assisted vulnerability research creates both opportunities and challenges.
On the defensive side, AI can help security teams inspect code, identify suspicious patterns, test potential weaknesses, and prioritize repairs. This may enable organizations to find problems earlier and respond more quickly.
However, attackers may also use AI to analyze software, adapt exploits, or automate parts of their operations. As complex technical tasks become easier to carry out, organizations may have less time to respond once a vulnerability becomes known.
This makes responsible disclosure, security testing, and rapid patching increasingly important. Researchers should coordinate with software maintainers so that fixes can be prepared before detailed exploitation information becomes widely available.
Organizations must also avoid assuming that an AI-generated finding is automatically correct. False positives, incomplete analysis, and incorrect patches remain possible. Human review and reproducible evidence are essential parts of a reliable security process.
What Should Website Owners Do?
Website owners and administrators should treat PHP2Shell as a serious security issue and verify whether their infrastructure is affected.
The PHP security team published fixes for supported branches, including:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Administrators should check the official PHP security advisory and obtain updates through their operating system, hosting provider, or trusted PHP distribution channel.
Older PHP versions that have reached end-of-life may not receive updates directly from the PHP project. Administrators using those versions should consult their vendors about available security fixes and plan to migrate to a supported release.
Website owners who use managed hosting should contact their provider to confirm that the relevant PHP runtime has been patched. Updating WordPress or a plugin alone may not resolve a vulnerability located in the PHP engine itself.
Security teams should also review relevant server logs and investigate signs of suspicious activity, particularly if a system remained exposed before it was patched.
Applying a security update is essential, but patching does not automatically remove malicious code or persistence mechanisms that may already have been installed. Systems with evidence of compromise may require a separate incident-response investigation.
Could AI Discover More Hidden Vulnerabilities?
PHP2Shell suggests that AI-assisted security research may become increasingly important. Software systems are large and complicated, and human researchers cannot manually inspect every possible execution path.
AI tools may help experts explore more possibilities, reproduce difficult bugs, and test fixes at a greater scale. These capabilities could improve the security of widely used software if organizations invest in responsible research and timely remediation.
However, AI is not a replacement for experienced security researchers, software engineers, or coordinated disclosure processes. Reliable discoveries require evidence, careful testing, and an understanding of how software behaves in real environments.
The long-term effect will depend on how developers, technology companies, governments, and security professionals use these tools.
Conclusion
PHP2Shell is an important example of how artificial intelligence is changing cybersecurity research. Human researchers led the investigation and worked with software maintainers, while AI models helped analyze complicated code, develop exploits, and test technical approaches.
The discovery demonstrates both sides of AI-powered cybersecurity. The technology can help defenders uncover dangerous flaws that may have remained hidden for years, but it can also lower the barriers to developing sophisticated attacks.
For website owners, the immediate priority is to apply the appropriate PHP security updates and investigate any signs of compromise. For the wider technology industry, PHP2Shell is a reminder that AI can make vulnerability research faster—and that secure software development, human oversight, and rapid remediation are more important than ever.