About 70% of the web needs to be patched ASAP 🤯

Repartage — contenu de Sagi Tzadik

About 70% of the web needs to be patched ASAP 🤯

At Wiz Research, we discovered and disclosed two critical remote code execution vulnerabilities – collectively named #PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

*The vulnerabilities affect every PHP version released over the past decade.*

The impact includes:

WordPress pre-auth RCE: ✅

Drupal pre-auth RCE: ✅

Joomla pre-auth RCE: ✅

Remote memory disclosure of any PHP application: ✅

If you manage PHP infrastructure, patch immediately.

As expected, AI played a central role in this research: these bugs were discovered using Wiz Atlas, Gemini 4 Argon, and OpenAI GPT-5.6 Sol.

Ahead of the disclosure, we worked closely with partners across the industry – including cloud providers, WAF vendors, and security platforms – to deploy day-one mitigations and help protect users worldwide.

Huge kudos to the team and partners involved: Nir Ohfeld, Shir Tamari, Tomer Schwartz, and our partners PHP Foundation, OpenAI and Calif

🔗 Research blog post: https://lnkd.in/dRN_fTep

🔗 Full technical breakdown & advisory: https://php2shell.com

510

23

41

510 reactions

Sources LinkedIn

• Profil : Pierre Jean Duvivier dit Sage (LinkedIn)
• Auteur partagé : Sagi Tzadik (LinkedIn)