PHP2Shell: Wiz Research discloses critical memory-safety flaws in PHP core enabling unauthenticated RCE (CVSS up to 9.2)
Wiz Research disclosed multiple memory-safety vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, and patched by the PHP team on October 21, 2026. The flaws allow unauthenticated remote code execution or disclosure of process memory (passwords, tokens, API keys, certificates) on any site running an…