Wiz Research said in its 21 October 2026 disclosure that it had found critical flaws in PHP with help from frontier AI models, including GPT-5.6 Sol and Gemini 4 Argon. The bugs affect releases dating back to PHP 5.4 and can expose server memory or allow remote code execution without authentication, according to the security team. Wiz put their severity as high as CVSS 9.2.
The flaws arise when PHP handles a fatal error, particularly one caused by running out of memory. An interrupted request can leave internal state corrupted for later use. Wiz said it combined bugs into an exploit that ran code without authentication against the latest container images of WordPress, Drupal and Joomla available when it tested them. Those demonstrations used particular deployments; the vulnerable code is in PHP itself.
Updating a website could therefore involve changing its PHP installation even when the application’s own code is sound. The team said adapting its exploit across deployments required testing how each handled memory, work the models helped it carry out in hours.
Wiz said it also used Wiz Atlas and credited Gemini 4 Argon with helping find the vulnerability, develop the exploit, detect attacks and validate the fix. PHP released a patch fixing multiple memory-safety vulnerabilities in its core engine on 21 October, according to Wiz.
_-1.jpg){kind=link}