PHP Site AuditSecurity research
What does it mean that AI helped discover PHP2Shell?
Wiz Research says frontier AI models helped its team analyze and develop proof-of-concept chains for bugs in PHP's core. That is a report about one research process—not proof that an AI independently discovered every flaw, that every PHP installation was exploited, or that a website is compromised.
What the researchers report
Wiz Research's October 21 account describes a human-led process that used AI tools alongside source analysis, testing and debugging to investigate memory-safety issues in PHP. The company says AI reduced the effort needed to reason about complex bug chains and develop demonstrations. PHP's own advisory independently describes two critical PHP-core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and publishes the upstream fixes.
Keep the roles clear. A research vendor's post is the primary account of its discovery methods; the PHP project is the authoritative source for release status and configuration guidance. Coverage or demonstrations can help explain technical impact, but they are not proof that every version, application or production website has the same exploit conditions.
Why the AI angle matters, and what it does not prove
Security teams have long used tools to search code, generate test cases and analyze crashes. More capable models can help connect observations, draft experiments or troubleshoot a complex build. That may change the time and specialist effort needed to explore a bug. It does not remove the need for humans to validate results, establish exploitability, report responsibly and coordinate a patch.
The phrase “AI discovered it” can compress a complicated sequence of choices and evidence. Ask what the model did, what researchers verified, how vendors reproduced the issue, and which exact software builds were tested. Avoid converting a researcher's demonstrated proof of concept into a claim that every site was attacked or that all older version strings indicate the same risk.
What a site owner should do
The practical response is the same regardless of which analysis tools helped find the issue: identify the PHP runtime serving the site, obtain the host or vendor's fix evidence for both CVEs, deploy the applicable package, and restart its workers. PHP's advisory and the related fixed-version guide provide the release details; vendor packages may use a different number when the fixes are backported.
If you see alarming headlines, separate confirmed facts from speculation. A published vulnerability is not evidence that your host was breached. Review the PHP notice and your provider's advisory, then ask your security team to examine relevant logs if there is evidence of suspicious activity. A public external assessment can describe response behavior but cannot confirm server-side patch state or rule out compromise.
Common questions
Did AI replace security researchers?
The cited research describes AI assistance within a broader process involving researchers, testing and coordinated disclosure.
Does an AI-assisted exploit mean my site was attacked?
No. Exploit capability and observed activity are distinct; compromise requires system-specific evidence.
Which source should decide the patch?
Use PHP and your distribution or hosting vendor for package status; use the research report to understand how the flaw was investigated.