Wiz describes the OPcache bug this way: "OPcache persists compiled PHP structures in shared memory and assigns indices into per-worker runtime-pointer maps." It says it "used this primitive to build an unauthenticated RCE chain against WordPress".

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers." The sentence describes PHP's overall use; it is not a count of servers affected by these flaws.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz's headline reads "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", and its conclusion says "With 70% of the Internet affected, the impact of PHP2Shell cannot be overstated." The page gives no method for the 70% figure; its executive summary describes 70% as the share of all websites PHP "powers". This differs from or adds to other sources: Wiz equates PHP's share of websites with the share affected. PHP's advisories state conditions by version and SAPI and give no share of sites affected.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says of its remote process-memory disclosure bug: "The attack works even when the application never calls session_start(), making the issue application-agnostic."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "These platforms illustrate the impact, but the vulnerabilities are in PHP itself. Exploitation does not depend on a flaw in the application's code: even a simple 'Hello World' application running on an affected PHP version can be vulnerable." This differs from or adds to other sources: Differs from PHP's advisories: GHSA-w8hw-w9fx-j79w reports no complete FPM exploit for CVE-2026-109618, and GHSA-6wmf-4rv5-p3rp says the validated FPM session path "depends on a suitable application operation".

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Rapid7 says of its own exploit attempts: "Our attempts so far have produced a working exploit only under narrow lab conditions, and exploitation depends on assumptions that are unlikely to hold on internet-facing instances." This differs from or adds to other sources: Differs in emphasis from PHP's advisory, which lists all PHP installations serving web requests as at risk, and from Wiz, which says even a simple Hello World application on an affected version can be vulnerable.

CVE-2026-109618 and CVE-2026-109619: Critical unauthenticated remote code execution in PHP · Rapid7 · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "Wiz Research would like to thank the PHP team, Calif and OpenAI for their work on discovery, coordination and patch verification."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz’s table of the bugs it reported lists, against CVE-2026-109619, "Fatal-error backtrace use-after-free" and "OPcache type confusion".

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz’s table of the bugs it reported lists, against CVE-2026-109618, "Upload-progress unserializer use-after-free" and "Remote process-memory disclosure".

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz’s disclosure timeline says Wiz Research reported the vulnerabilities to the PHP security team on 24 August 2026.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz’s disclosure timeline says that on 19 August 2026 "Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says in its post of 21 October 2026: "Wiz Research uncovered multiple critical vulnerabilities in core PHP".

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Calif says in its write-up that the two vulnerabilities (CVE-2026-109618, CVE-2026-109619) were "discovered by Calif, OpenAI and Wiz".

php2shell: a tale of two PHP remote vulnerabilities · Calif · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says in its post of 21 October 2026: "Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4."

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

Wiz says in its post of 21 October 2026 that core PHP "powers 70% of all websites in the world".

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Wiz · archived copy · checked 23 Oct 2026 · Cite this fact · the story

OpenAI says PHP's maintainers led the fixes and release, with OpenAI's teams and partners including Wiz and Cloudflare contributing research, technical support and coordination.

Patch the Planet: global response coordination as agents uncover critical vulnerabilities · OpenAI · archived copy · checked 23 Oct 2026 · Cite this fact · the story

OpenAI says Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, and that Wiz independently discovered and reported both vulnerabilities.

Patch the Planet: global response coordination as agents uncover critical vulnerabilities · OpenAI · archived copy · checked 23 Oct 2026 · Cite this fact · the story