PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Researchers at Wiz, leveraging AI-assisted analysis, discovered critical remote code execution (RCE) vulnerabilities in the core PHP engine, dubbed PHP2Shell. These flaws potentially affect approximately 70% of the Internet, given PHP's widespread deployment. The vulnerabilities enable attackers to execute arbitrary code remotely on affected servers. Additionally, a Heartbleed-style memory disclosure vulnerability was identified, which could expose sensitive data from server memory. The severity and breadth of affected systems make this a critical issue comparable to historical vulnerabilities like Heartbleed. Organizations running PHP-based web infrastructure are urged to apply patches immediately. The discovery highlights the growing role of AI in identifying complex, systemic vulnerabilities in foundational web technologies.