PHP2Shell: AI uncovers critical RCE in PHP

pettijohn

Silly question, is PHP part of Project Glasswing? Crazy this has been dormant for a decade. And scary to wonder what else is lurking out there.

sehw

Ye, no humans but "AI".

tchalla

> We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.

asbv-1qq

The flaw was in at least 20 year old code, which seems to be a common theme for AI discoveries. No compute costs for finding the issue or for writing the exploit are disclosed. But it is marketed as if it were the first RCE found in human history.

simonw

Timeline from that article: August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. August 20, 2026: Unauthenticated RCE is confirmed against Drupal. August 21, 2026: Unauthenticated RCE is confirmed against WordPress. August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team. September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix. October 21, 2026: Patched PHP releases become available. October 21, 2026: Public disclosure. I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?

Topfi

Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing, especially the month that passed before an acknowledgment. Edit: Apparently this had been reported more than half a decade ago [0]. I am getting more confused the more I look into this, hopeful for a well written, factual post-mortem from someone who hasn't actively avoided PHP for the last decade. [0] https://news.ycombinator.com/item?id=50181395

edh649

Seems to have been prompted from research by calif.io who started disclosure on August 11 vs Wiz on August 24th? A bit unclear on the participants and how they all interacted... https://calif.io/php2shell/

mg794613

I'm so tired of some of these "research setups", do you really need a logo, a brand and everything setup so you can cash in? Was this truely a problem or artificially created? Especially after fumbling it like this. "Buy our product, because we found a bug", yeah and you leaked it too.

wildmXranat

Did anyone find a reputable source for code which can be used to validate fixes ?

jongjong

Damn. I've been saying that writing correct software is almost impossible. I suspect it's a matter of time before all mainstream blockchain projects are cracked. Many of those projects are hundreds of thousands of lines of code. There's no way they don't have vulnerabilities given that AI is now uncovering so many vulnerabilities in such high exposure projects. I was a code minimalist before, now I'm a radical minimalist. We need to get the lines of code down to the absolute minimum. Attack surfaces need to be clearly defined, enumerable and testable under all possible conditions.

NooneAtAll3

Ai fumbles responsible disclosure*

airtnp

Ok, based on my reads on Wiz and Calif writeups, there are 5-6 issues mapped to 2 CVEs. Wiz (with GPT 5.6 Sol + Gemini 4 Argon) : Remote process-memory disclosure; OPcache type confusion; Fatal-error backtrace UAF. POC on Wordpress, Drupal and Joomla Calif (with LLM, no specific model, but model is accessible to all): Zend HashTable OOM. Targets PHP-FPM and mod_php. Both discovers the UAF on upload progress unserializer. Surprised to see the anime girl dancing with POC is really uploaded by Calif researchers.

wren6991

Did an LLM do the write-up? Half of the "technical deep dive" was just re-stating earlier statements about scope and impact, and I left without a solid grasp of the mechanics of the exploits.

eptcyka

I guess I should update my nextcloud. No, scratch that. I should replace it with something that is not a trash fire.

varispeed

If AI "uncovered" it, that means it was already in the training data and likely exploited in the wild.

ang_cire

> PHP powers approximately 70% of websites, Well, that's my depressing statistic for the day...

chasil

Does active SELinux (as used in Red Hat derivatives) limit the damage at all? I built some rhel7 systems that are relaying user-provided LDAP credentials into a domain controller, and these are probably wide open with these flaws. I would hope that SELinux would prevent the launch of a shell, at least. Does PHP built with FORTIFY_SOURCE and other RedHat-recommended compiler flags help?

WJW

From the related article on calif.io: > We therefore control where PHP places a pointer and its associated type information. This is application-dependent RCE under both Apache mod_php and PHP-FPM. Both articles describe how you can end up with freed memory that still has pointers into it. I can understand that this should never be possible, but it seems to me that both articles skip the very important step of how to actually turn this into RCE? From my (admittedly limited) understanding of these things you would not only need to write arbitrary memory, but also need to be able to jump to the relevant address to execute such things. Or do they overwrite the PHP (byte)code with their own and then just let the interpreter do its thing?

schleck8

Looking at the technical deep dive further down the article, this is worse than Log4Shell if you need a point of reference. It's one of the two worst exploits that ever publicly surfaced, up there with EternalBlue.

rbanffy

Maybe a silly question, but is there any full-featured CMS suitable for large-ish organizations that's been undefeated in terms of security? The only one that comes to mind is Plone (which is used extensively in the Brazilian government), but there has to be more.