Wiz Employs AI Models to Uncover Critical PHP2Shell Flaws
Security firm Wiz reported using AI models, including Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, to discover two PHP2Shell flaws tracing back to PHP 5.4 in 2012. The PHP team released patches on October 21.
The PHP team patched the critical PHP2Shell vulnerabilities on October 21. Cybersecurity firm Wiz stated the flaws stem from incomplete clean-up of internal state during out-of-memory errors, leading to use-after-free weaknesses. Wiz noted that manual verification of exploitable attacks was previously difficult, but frontier AI models helped eliminate research barriers across platforms like WordPress before responsible disclosure.
Key takeaways
- Wiz stated researchers leveraged multiple AI models in late August to discover and verify two vulnerabilities present since PHP 5.4 was released in 2012.
- Beyond remote code execution, Wiz noted attackers could also exploit the flaws to read sensitive credentials, tokens, and API keys from PHP process memory.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.