There isn't an easy exploit for this PHP vulnerability

Elias Taylor's post, written on October 21, the day PHP shipped its fix, is a dissent about php2shell, the PHP vulnerability tracked as CVE-2026-109618 and CVE-2026-109619. His post never names it in the text, but one of the proof-of-concept repositories he links is named after those two CVEs, and the timing matches. According to Wiz's disclosure, these are memory-safety bugs in PHP's core engine: when an out-of-memory error kills a request partway through, PHP can leave stale internal state behind, and a later request or another worker can reuse it, leading to memory disclosure or memory corruption that can be turned into code execution. OpenAI's Greg Brockman described the two-month coordinated disclosure effort and called it one of the most severe open-source bugs in recent memory, in a thread about the same vulnerability.

Taylor does not say the bug is harmless. He writes that "there's clearly a bug here and it really does matter," but argues it is nowhere near as easy to exploit as Log4Shell, Heartbleed, Shellshock or the old Ruby on Rails YAML bug, where a single crafted request was enough and botnets followed almost immediately. His evidence is the flood of public proof-of-concept exploits on GitHub, which he says do not work against a vanilla PHP instance. Many, he says, depend on local file inclusion, an existing application flaw that lets an attacker make the server run a file of their choosing, which he calls an "insane pre-requisite" for something billed as an attack on any PHP server. He blames language models: in his account, people asked a model for an exploit and got one that quietly made the test server vulnerable. These are his observations; the post invites readers to run the exploits themselves but does not show his own test setup or results.

Read against the disclosure, the evidence he offers is narrower than his headline. It concerns the public exploits about ten hours after disclosure, by his count. Wiz says it combined the bugs into its own exploit script, also called php2shell, and achieved unauthenticated remote code execution against the then-latest WordPress, Drupal and Joomla container images, adding that even a simple "Hello World" application on an affected version can be vulnerable. Wiz also says that doing so meant chaining several flaws and adapting to each target's memory layout through repeated testing, work it says frontier models made practical, and it calls exploitation possible "in some cases fairly easily." Both accounts can hold at once: Taylor may be right that the public exploits circulating when he wrote did not work against an ordinary PHP setup, while Wiz reports that a determined team can still exploit the bug. Wiz says applying the PHP update is the only complete fix, and nothing in Taylor's post argues otherwise.