Wiz says: "There are other variants outside of these four bugs. While we initially reported these four to PHP, through this research we realized the vulnerability is deeply rooted in the PHP codebase and will require a comprehensive fix. Other variants should also fold under the same two CVEs."

The exact words it rests on

There are other variants outside of these four bugs. While we initially reported these four to PHP, through this research we realized the vulnerability is deeply rooted in the PHP codebase and will require a comprehensive fix. Other variants should also fold under the same two CVEs.

What the source said when we opened it, on 23 Oct 2026.

The source

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Wiz · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 23 Oct 2026, against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026