On October 21, 2026, critical vulnerabilities discovered by Wiz Research in the core PHP engine sent shockwaves through the cybersecurity industry. PHP powers approximately 70% of the world’s websites, including major platforms such as WordPress, Drupal, Joomla, and Wikipedia’s MediaWiki. 

Dubbed PHP2Shell, the vulnerabilities include memory disclosure and unauthenticated remote code execution (RCE), potentially allowing attackers to take control of affected servers, steal sensitive data, and compromise websites. Critically, these vulnerabilities exist in PHP itself, independent of the applications running on top of it. Every PHP version released over the past decade is affected by at least one of the vulnerabilities, prompting the release of emergency security patches on October 21. 

Mobile apps are becoming AI-assisted and agentic, creating new opportunities for attackers to manipulate the requests, data, and context reaching Mobile LLM gateways. Learn which mobile controls help secure that handoff and protect against prompt injection and model jailbreaking.