PHP patches two critical flaws found with help of frontier AI
Wiz Research says frontier AI models made long-standing flaws in the PHP engine exploitable; PHP released the patch on October 21, 2026.
By GennnAi··1 min read
Grouped under two CVEs, with severity up to CVSS 9.2, the memory-safety flaws allow unauthenticated remote code execution or memory disclosure. Every PHP version since 5.4 is affected by at least one. Wiz says it built working exploits for WordPress, Drupal and Joomla within hours, and thanks the PHP team, Calif and OpenAI. Wiz compares it to Heartbleed and Log4Shell as a possible turning point.
Source: Wiz Research, published on October 21, 2026.