Wiz Research Discloses PHP2Shell Bugs Rated 9.2 and Exploited Before Patch
Summary
Wiz Research discloses PHP2Shell, memory-safety bugs in core PHP that allow unauthenticated remote code execution and are rated up to CVSS 9.2. PHP shipped fixes on October 21, but AWS says attackers exploited the flaws before disclosure. The bugs affect PHP 5.4 and later, so patching PHP 8.x runtimes is urgent.
Key Points
- The NSA tells organizations to patch PHP or take affected systems offline.
- Wiz says Gemini 4 Argon and GPT-5.6 Sol chained the bugs and adapted exploits to each target's memory layout.
- Wiz demonstrates pre-auth remote code execution on stock WordPress, Drupal and Joomla containers.