# PHP2Shell: Dissecting 2 Critical PHP RCE Flaws Discovered via AI
Two critical Remote Code Execution (RCE) vulnerabilities with CVSS 4.0: 9.2 severity ratings have been disclosed in the PHP core runtime. Exploitation requires zero authentication and targets the internal Zend memory management engine.
## What is PHP2Shell?
Over the past few days, PHP2Shell has become a prominent topic in the global cybersecurity community. The name designates two critical vulnerabilities in PHP that enable unauthenticated remote threat actors to execute arbitrary code (Remote Code Execution / RCE) on unpatched host servers.
Unlike commonplace flaws located inside CMS plugins or third-party themes (such as WordPress or Drupal extensions), this vulnerability exists directly within the core PHP runtime interpreter (the Zend Engine). Consequently, even if a web application possesses zero SQL Injection or File Upload bugs, the host machine remains exposed if the underlying PHP runtime has not received the security patch.
## Discovered with AI Assistance: Ryan Austin & Wiz Team
What makes this incident a landmark milestone in offensive and defensive security research is the active role played by frontier artificial intelligence:
Ryan Austin, a security researcher at Calif, utilized the frontier AI model GPT-5.6 Sol during the Patch the Planet initiative to audit and reason through legacy C source code across the PHP repository, ultimately discovering one of the memory corruption paths.
Independently, the Wiz Research Team uncovered and responsibly reported both vulnerabilities to the upstream PHP maintainers.
Following verified proof-of-concept submissions, the researchers worked closely with the PHP core team under a Coordinated Vulnerability Disclosure framework to deploy fixes before technical exploitation details went public.
This does not imply that AI discovered the full chain in isolation. Skilled researchers still had to interpret the codebase, validate hypotheses, build reproducible triggers, and verify remediation patches. Nevertheless, PHP2Shell demonstrates that AI dramatically speeds up finding deeply buried flaws in foundational software.
## Technical CVE Exploitation Flow
The vulnerability is triggered during Out-Of-Memory (OOM) handling inside the Zend Engine when executing C `longjmp()` exception unwinding:
+-------------------------------------------------------------------------+
| PHP2Shell (RCE) Execution Attack Path |
+-------------------------------------------------------------------------+
[ Malicious HTTP Payload Delivered by Remote Attacker ]
|
v
[ Heap Allocation Exceeds Server memory_limit ]
|
v
[ Zend Engine Triggers Fatal Out-of-Memory (OOM) Condition ]
|
v
[ C longjmp() Routine Invoked to Abort Active Request ]
|
+--------------+--------------+
| |
v v
[ CVE-2026-109618 ] [ CVE-2026-109619 ]
Request-bound Memory Dangling Global Pointer
Fails Clean State Reset References Freed Heap Region
(Memory Safety Bypass) (Use-After-Free / State Leak)
| |
+--------------+--------------+
|
v
[ Subsequent Request Cycle Reads Corrupted Heap State ]
|
v
[ EXPLOITATION SUCCESSFUL: Arbitrary Remote Code Execution (RCE) ]## Remediation & Patching Guidance
The PHP maintainers have shipped official patches resolving both flaws: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Server administrators should immediately audit running PHP binaries and upgrade accordingly: