How Wiz Found PHP2Shell With AI in One Week — and How AI Now Fixes It at Enterprise Scale

Today Wiz Research disclosed PHP2Shell — two critical memory-safety bugs in PHP's core engine that allow unauthenticated remote code execution on 70% of the internet. CVSS 9.2. Active exploits in the wild. 22.6 million vulnerable servers identified in the first hours after disclosure.

What most writeups will miss: the story of how Wiz found it is more important than the CVE itself.

How Wiz Actually Found This

Wiz didn't stumble onto PHP2Shell. They went hunting using Wiz Atlas, augmented with Gemini 4 Argon and GPT-5.6 Sol.

Step 1 — Triage at scale: Wiz Atlas ingested PHP's entire C source tree and flagged 47 highest-risk functions. One researcher triaged in hours what previously took a team weeks.

Step 2 — Bug pattern matching: Gemini 4 Argon applied patterns from prior PHP CVEs to identify zend_exception_handle() as a use-after-free candidate.

Step 3 — Exploit chain construction: GPT-5.6 Sol generated a working exploit chain. Human researcher validated. Total time: ~one week.

Step 4 — Patch validation: Automated regression testing confirmed PHP 8.2.35 as the fix. One researcher. One week. CVSS 9.2.

What PHP2Shell Does

CVE-2026-109618: Use-after-free in zend_exception_handle() during fatal error cleanup triggered by crafted multipart/form-data POST. No auth required.

CVE-2026-109619: Same class of bug in OPcache during memory constraint checks.

Patch Table

The Fix (3 files, no logic changes)

Dockerfile:

FROM php:8.2.35-fpm-alpine # was 8.2.34 

composer.json:

"platform": { "php": "8.2.35" } 

CI pipeline:

php-version: '8.2.35' # was '8.2.34' 

The Bigger Picture: AI-Assisted Discovery Changes Everything

This is not just a story about a PHP bug. It's a signal that AI-augmented security research has arrived at production scale. What Wiz demonstrated with Gemini and GPT-5.6 Sol is the same capability being built into autonomous engineering platforms.

At Cognitive Daniel, we're applying this same principle in reverse — not just finding vulnerabilities, but autonomously patching them across entire enterprise fleets. The same AI-accelerated pattern recognition that Wiz used to discover CVE-2026-109618 in a week can be used to remediate it across thousands of servers without human intervention per-server.

Proof-of-concept: https://github.com/2badagoldman/cognitive-daniel/tree/main/demos/php2shell-fix

Full writeup: https://www.cognitivedaniel.com/blog/wiz-found-php2shell-daniel-fixes-it-at-scale

*If your team is still patching PHP vulnerabilities manually server-by-server, [let's talk] https://www.cognitivedaniel.com/