PHP2Shell: AI uncovers critical RCE in PHP
本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。
Executive Summary
Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them. PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.
Wiz Research 发现了核心 PHP 中的多个关键漏洞。PHP 是一种流行的通用脚本语言，为全球 70% 的网站提供支持。攻击者若成功利用这些漏洞，可能控制受影响的服务器、窃取敏感数据并篡改网站。PHP 是互联网的基石，WordPress、Joomla、Drupal、维基百科的 MediaWiki 等众多平台均基于此语言构建。
These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk. Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.
这些漏洞包括 PHP 自身存在的内存泄露和未经身份验证的远程代码执行问题，且与运行在其上的应用程序无关，使所有受影响的网站面临直接风险。过去十年发布的每个 PHP 版本（追溯至 5.4 版本）都至少受到其中一个漏洞的影响。攻击者可以远程利用这些漏洞，在某些情况下甚至相当容易。强烈建议立即进行补丁更新。
On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine. These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
2026 年 10 月 21 日，PHP 发布了补丁，修复了核心引擎中的多个内存安全漏洞。这些发现属于 PHP 历史上最严重的漏洞之列，甚至在软件史上也堪称重大。其潜在缺陷已存在数十年，但要证明其可利用性，需要极其复杂的步骤链，这已达到人类研究人员实际操作的极限。前沿 AI 模型大幅降低了这一门槛，将一个长期存在的缺陷转化为了可利用的漏洞。
Overview
In this post, we explain how frontier AI helped us find and fix vulnerabilities that had remained hidden in the PHP codebase for more than a decade. The issues described below all stem from key architecture decisions, some made over a decade ago, and were grouped under two CVEs, with severity reaching CVSS 9.2. The work grew into a cross-industry effort to protect customers, find variants, deploy detections and mitigations, and verify a patch in time for coordinated disclosure.
在这篇文章中，我们解释了前沿 AI 如何帮助我们发现并修复了隐藏在 PHP 代码库中十多年的漏洞。下文描述的问题均源于关键的架构决策（部分决策可追溯至十多年前），这些问题被归类为两个 CVE，严重程度达到 CVSS 9.2。这项工作最终演变成了一项跨行业的协作，旨在保护客户、发现变体、部署检测与缓解措施，并及时验证补丁以进行协调披露。
Nearly every PHP version is affected by at least one of these issues, including releases dating back to PHP 5.4. The vulnerabilities can allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. That memory may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself.
几乎每个 PHP 版本都受到其中至少一个问题的影响，包括追溯至 PHP 5.4 的版本。这些漏洞允许未经身份验证的攻击者在受影响的服务器上执行代码或读取敏感的进程内存。这些内存可能包含属于其他请求或服务器本身的密码、身份验证令牌、API 密钥和证书。
PHP is the programming language behind much of the web, powering WordPress, Drupal and MediaWiki, the software that runs Wikipedia. A flaw in its core engine can affect websites across this ecosystem, even when their own application code is secure.
PHP 是支撑互联网大部分内容的编程语言，为 WordPress、Drupal 以及运行维基百科的 MediaWiki 等软件提供支持。其核心引擎中的缺陷可能会影响整个生态系统中的网站，即使这些网站自身的应用程序代码是安全的。
Some vulnerabilities become turning points because they challenge fundamental assumptions about security. In 2014, Heartbleed exposed the fragility of shared infrastructure securing the internet. In 2021, Log4Shell revealed how deeply embedded software dependencies could create widespread exposure that organizations struggled to identify. We believe PHP2Shell could mark a similar turning point for the AI era, illustrating how AI can change the practical exploitability of longstanding vulnerabilities.
一些漏洞之所以成为转折点，是因为它们挑战了关于安全的基本假设。2014 年，Heartbleed 暴露了互联网安全共享基础设施的脆弱性。2021 年，Log4Shell 揭示了深度嵌入的软件依赖项如何造成组织难以识别的广泛风险。我们认为 PHP2Shell 可能标志着 AI 时代的类似转折点，它展示了 AI 如何改变长期漏洞的实际可利用性。
Building the exploit required chaining multiple flaws and adapting to each target’s memory layout through repeated testing and debugging. Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours. As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice.
构建该漏洞利用程序需要链接多个缺陷，并通过反复测试和调试来适应每个目标的内存布局。前沿模型对于使这一过程变得可行至关重要，使我们能够在数小时内开发并适配跨多个应用程序的有效利用程序。随着完成此类工作所需的时间和专业知识减少，复杂性可能不再构成有效的屏障，这将改变我们对实际“易受攻击”的定义。
Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification. OpenAI and Calif also published blogs containing details on the vulnerability – its history, technical details, and insight into the disclosure process. PHP posted as well.
Wiz Research 感谢 PHP 团队、Calif 和 OpenAI 在漏洞发现、协调和补丁验证方面所做的工作。OpenAI 和 Calif 也发布了博客，详细介绍了该漏洞的历史、技术细节以及对披露过程的见解。PHP 团队也发布了相关公告。
We’d also like to express our sincere gratitude towards Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel, and many others, for helping prepare guidance and out-of-the-box mitigations for customers who cannot apply the patch immediately.
我们还要向 Automattic、Akamai、AWS、Cloudflare、Fastly、Google、Imperva、Microsoft、Vercel 等众多公司表示诚挚的感谢，感谢他们为无法立即应用补丁的客户准备了指导建议和开箱即用的缓解措施。
The Vulnerabilities
All of the disclosed vulnerabilities are memory-safety issues that stem from bugs in how PHP handles fatal errors while processing requests, particularly out-of-memory errors. These bugs can leave a corrupted internal PHP state behind after a request ends unexpectedly. A later request or worker can reuse that stale state, leading to memory disclosure or corruption.
所有披露的漏洞均为内存安全问题，源于 PHP 在处理请求（特别是内存溢出错误）时处理致命错误的方式存在缺陷。这些错误可能在请求意外结束后留下损坏的 PHP 内部状态。后续的请求或工作进程可能会重用该陈旧状态，从而导致内存泄露或损坏。
Below you can find a table that demonstrates what type of impact was demonstrated by each of the bugs we reported to PHP. The applications listed below are targets we chose for the RCE demonstrations. They are representative targets - exploitation does not require one of these CMSs, as the vulnerable code is in PHP itself.
下表展示了我们向 PHP 报告的每个漏洞所带来的影响类型。下文列出的应用程序是我们选择用于远程代码执行（RCE）演示的目标。它们是具有代表性的目标——利用漏洞并不一定需要这些内容管理系统（CMS），因为易受攻击的代码位于 PHP 本身之中。
| Tracking ID | Bug | What an attacker can achieve | What we demonstrated |
|---|---|---|---|
| CVE-2026-109618 | Upload-progress unserializer use-after-free | Remote process-memory disclosure; Corrupt process memory and execute code | Unauthenticated disclosure of PHP worker memory; Pre-authentication RCE on WordPress, Drupal and Joomla; Application-agnostic remote memory disclosure |
| CVE-2026-109619 | Fatal-error backtrace use-after-free; OPcache type confusion | Corrupt process memory and execute code; Corrupt shared PHP state and execute code | Pre-authentication RCE on Drupal; Pre-authentication RCE on WordPress |
| 追踪 ID | 漏洞 | 攻击者可实现的目标 | 我们演示的内容 |
|---|---|---|---|
| CVE-2026-109618 | 上传进度反序列化释放后重用 (Use-after-free) | 远程进程内存泄露；损坏进程内存并执行代码 | 未经身份验证的 PHP 工作进程内存泄露；针对 WordPress、Drupal 和 Joomla 的预身份验证 RCE；与应用程序无关的远程内存泄露 |
| CVE-2026-109619 | 致命错误回溯释放后重用；OPcache 类型混淆 | 损坏进程内存并执行代码；损坏共享 PHP 状态并执行代码 | 针对 Drupal 的预身份验证 RCE；针对 WordPress 的预身份验证 RCE |
While this blog covers only four instances of exploitable bugs (grouped under two CVEs) that follow this problematic pattern, there are other tracked, and likely untracked, variants of this issue in the PHP codebase. These variants have different requirements for exploitation and can lead to different types of impact. In any case, the patch provided by the PHP team fixes the issue at its core and eliminates all variants in the patched release.
虽然本博客仅涵盖了遵循此问题模式的四个可利用漏洞实例（归类为两个 CVE），但 PHP 代码库中还存在其他已追踪及可能未被追踪的变体。这些变体对利用的要求不同，并可能导致不同类型的影响。无论如何，PHP 团队提供的补丁从根本上修复了该问题，并在补丁版本中消除了所有变体。
Impact
We combined these vulnerabilities into a single exploit script, php2shell, and demonstrated that it could execute code remotely without authentication on deployments of WordPress (wordpress:latest), Drupal (drupa
我们将这些漏洞组合成一个名为 php2shell 的单一利用脚本，并演示了它可以在 WordPress (wordpress:latest) 和 Drupal (drupa) 的部署中无需身份验证即可远程执行代码。