🛡️PHP2Shell Bug Lets Attackers Run Code on WordPress and Drupal Servers

Your PHP servers need patching before AI finds the next one

A bug in PHP that most people assumed was harmless just became a way to run arbitrary code on a server. Researchers found that an out-of-memory error, normally just a crash, could be chained into remote code execution. WordPress and Drupal sites are the obvious exposure, and the researchers' AI tooling is the reason the chain got found. If you run PHP in production, this is your problem. Most WordPress and Drupal installs sit on boxes nobody has touched in months, and that's the attack surface. The researchers alerted the PHP Foundation right away, and a patch landed before any bad actors had the exploit. The catch: the underlying bug was reported as far back as 2024, which means it sat around for a long time. The patch took a team of four engineers two months to build. The original bug report dates to 2024, and the exploit chain was disclosed in late October. Nobody exploited it in the wild before the fix. Bottom line: this one got lucky, and the next one might not. Update PHP and your CMS plugins this week.