AI-found PHP flaws allow remote code execution on nearly every PHP release back to 5.4

Wiz Research, working with frontier models from OpenAI, found two unauthenticated remote code execution bugs in PHP's core engine. They sit in the upload-progress unserializer and in fatal-error backtrace handling. Wiz says nearly every PHP version is affected, including releases dating back to 5.4, and that the flaws can also expose memory holding passwords, tokens and API keys. The disclosure was coordinated with the PHP team, OpenAI and Calif, and several infrastructure providers, including Cloudflare, Fastly, Akamai and Google, published protections. PHP is the language behind much of the web, including WordPress and Drupal. Wiz also says the underlying flaws had been present for decades, which the company links to the difficulty of proving they were exploitable. For AI builders, the lesson is about speed. Models now find old bugs in widely deployed code, so the window between disclosure and exploitation may shrink. Anyone running PHP services or plugins should patch the same day, check whether a WAF rule is in place, and review what secrets sit in process memory.