Wiz says AI models turned long-standing PHP memory bugs into working remote-code-execution chains

Wiz Research reports two CVEs in core PHP, CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2, affecting releases back to PHP 5.4. PHP published patched releases on October 21. Wiz says the bugs come from how PHP handles fatal out-of-memory errors, leaving stale state that a later request can reuse. It reports demonstrating unauthenticated code execution on the latest WordPress, Drupal and Joomla container images, and unauthenticated reads of PHP worker memory that can hold passwords, tokens and API keys. The "70% of websites" figure is Wiz's.

The AI claim is Wiz's too. It says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and that a single researcher completed in a week what would have taken a world-class team months. Its timeline runs from first discovery on August 19 to report on August 24, PHP acknowledgment on September 21, and patch and disclosure on October 21. The post gives no human-only baseline for that comparison.

Why it matters: Patching PHP is the immediate action. If Wiz is right that models make per-target exploit adaptation cheap, the gap between a patch landing and exploitation of unpatched servers shrinks, and that is a reason to shorten your own time-to-patch.