Wiz

The PHP security team has released emergency security patches for two critical remote code execution (RCE) vulnerabilities, collectively named PHP2Shell, that affect all PHP installations serving web requests. The flaws, discovered by researchers from Calif, Wiz, and OpenAI, allow unauthenticated attackers to achieve code execution with web worker privileges. The PHP team stated that the highest risk is for servers using mod_php, where an exploit can be triggered before any application code runs.