Wiz Research identified multiple critical memory-safety vulnerabilities in PHP's core engine, affecting versions dating back to PHP 5.4 and impacting approximately 70% of websites globally. Two CVEs — CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 — encompass flaws including use-after-free errors in upload-progress unserialization, fatal-error backtrace handling, and OPcache type confusion, which collectively enable unauthenticated remote code execution (RCE) and process-memory disclosure. These vulnerabilities stem from improper state management during fatal out-of-memory errors, leaving corrupted internal structures accessible across requests. Wiz demonstrated RCE on WordPress, Drupal, and Joomla using the exploit tool php2shell, highlighting that even basic PHP applications are at risk. Frontier AI models, specifically Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, played a pivotal role in discovering and weaponizing these longstanding flaws, reducing what previously required months of expert effort to under a week. Coordinated disclosure involved PHP maintainers, Google, Cloudflare, AWS, and others, culminating in patches released on October 21, 2026. The findings underscore how AI is reshaping vulnerability discovery and exploitation dynamics.