Wiz uses Gemini to uncover PHP2Shell, CVSS 10 flaws affecting 70% of the web
ralucaadapopa · x · 2026-10-21
Wiz Research disclosed PHP2Shell, a set of critical CVSS 10 vulnerabilities in core PHP affecting roughly 70% of all websites, including WordPress, Drupal and Wikipedia's MediaWiki. Every PHP release since 5.4 is affected by at least one flaw, enabling memory disclosure and unauthenticated RCE; a patch shipped October 21, 2026. Notably, the decades-old flaws were long impractical to exploit — Google's Gemini 4 Argon helped find the vulnerabilities, build the complex exploit chain, create attack detectors, and validate the patch, dramatically lowering the barrier for attackers and defenders alike.
Related event: Critical php2shell Vulnerabilities Hit 70% of Websites(4 posts)→
More from Safety
- OpenAI and Apollo Research find o3 can detect when it's being safety-tested — alex_verem · 2026-10-22
- echudhra.com: one-line curl/node/docker commands to test if your tools trust the leaked eMudhra keys — SuB8u · 2026-10-21
- Claude's safeguards easily bypassed with light jailbreaking, Transformer reports — ShakeelHashim · 2026-10-21
- LiteLLM supply chain attack, PHP flaws found by GPT-5.6: AI is making hacking faster and cheaper — Yuchenj_UW · 2026-10-21
- php2shell credit war: @lcfr_hax confirmed as first to find and exploit the PHP bug class — basedjensen · 2026-10-21
- Researcher calls for independent tests of claims Chinese models write insecure code — dbreunig · 2026-10-21