Wiz Says Gemini 4 Argon Cut PHP Exploit Building to Hours
Summary
Wiz Research reports two PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, enabling unauthenticated remote code execution and memory disclosure on sites running affected versions, including WordPress, Drupal and Joomla. PHP issued patches on October 21, 2026. Wiz says frontier models such as Gemini 4 Argon cut exploit work to hours.
Key Points
- Wiz Research rates the two PHP2Shell flaws at CVSS 9.2, calling them among the most severe vulnerabilities discovered in software history.
- Every PHP release since version 5.4 carries at least one of the flaws, Wiz Research reports.
- Wiz Research says a single researcher completes in a week work that previously took a world-class team months.