AI
AI-assisted research turns longstanding PHP memory bugs into practical remote exploits
Wiz Research says frontier AI helped turn longstanding PHP memory-safety flaws into working unauthenticated exploits, while PHP made security releases available for two CVEs. The researchers demonstrated code execution against representative WordPress, Drupal and Joomla containers and memory disclosure from PHP workers. Their account argues that AI reduced the specialist effort needed to adapt complex exploit chains across environments, potentially changing which old vulnerabilities are practically exploitable. The claims come from the discovering vendor, while PHP’s patch is the complete remediation.
Editorial summary · Publisher article
What matters
- The flaws affect PHP itself rather than a specific content-management system, so even simple applications can be exposed.
- Wiz says the exploit chains required repeated testing and adaptation to versions, configurations and memory layouts.
- The researchers attribute major contributions to Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, alongside coordinated work with PHP and infrastructure providers.
The security significance
The disclosed bugs involve stale or corrupted internal state surviving fatal errors and being reused across requests or workers. Wiz reports memory disclosure and remote code execution, including access to secrets held in process memory.
The AI argument
Wiz’s central claim is that AI did not create the underlying flaws but made exploit development and adaptation practical enough to scale. The same tools may also help defenders discover and fix vulnerabilities that resisted earlier review.
Context & caveats
- The scope, severity and AI contribution are described by Wiz Research, the company that found and disclosed the vulnerabilities.
Why this made the edition
The research account supplies substantial independent technical detail, confirmed demonstrations against major PHP applications and evidence about AI-assisted exploit development, while clearly attributing claims to Wiz Research.
Source material