Breaking Down PHP2Shell with Sagi Tzadik & Thai Duong

Summary
In this episode of Wiz’s Crying Out Cloud podcast, host Amitai interviews security researchers Sagi Tzadik (Wiz Research) and Thai Duong (Calif) about the discovery, exploit development, and disclosure of “PHP2Shell.” They explain how frontier AI models and agentic workflows were used by both research teams to independently discover and build end-to-end remote code execution (RCE) exploits against core PHP error handling and memory allocation across major versions, and detail the coordinated multi-vendor patching effort.

What is shown

• [00:00] Cold open with Sagi Tzadik discussing how frontier AI capabilities in memory corruption exploitation altered his view on automated vulnerability research.
• [00:20] Host Amitai introduces the podcast and guests Sagi Tzadik (Wiz Research) and Thai Duong (Calif).
• [00:31] Tri-split video call layout featuring Amitai (top left), Sagi (top right), and Thai (bottom center) against a Wiz branded backdrop.
• [04:38] Sagi describes Wiz’s internal vulnerability research harness, “Atlas,” running on models including Gemini 4 and GPT-5.6 Sol.
• [05:01] Description of the prompt and workflow: targeting Drupal CMS, having Atlas discover memory corruption in PHP, and then prompting it to port the exploit to WordPress, which led to the discovery of the generic PHP2Shell vulnerability.
• [06:36] Thai details Calif’s work with OpenAI’s frontier access program and how their researcher Ryan discovered the same underlying bug family traced back to Stefan Esser’s 2004 research.
• [19:08] Description of autonomous agentic exploit generation across divergent PHP versions (e.g., PHP 5.4 and PHP 8.5) using spawned sub-agents.

Claims & numbers

• The presenter says PHP2Shell allows remote code execution (RCE) on web servers running PHP applications—including empty PHP scripts—by interrupting memory allocations to trigger a use-after-free condition (01:44).
• The presenter states that the root vulnerability concept traces back to research published by Stefan Esser around 2004 (02:22).
• Sagi states that Wiz discovered the bug using their internal harness “Atlas,” which runs on frontier models including Gemini 4 and GPT-5.6 Sol (04:42).
• Sagi states that Atlas ran for a couple of hours against Drupal, and an adaptation task for WordPress took roughly 8 hours before finding the broader generic PHP bug (05:18, 05:41).
• Thai claims the vulnerability affects major PHP releases across versions 5.x, 7.x, and 8.x (03:49).
• Thai claims that an internal PHP audit flagged a similar memory issue in 2024, but developers at the time could not develop a working exploit and did not patch it due to complexity (08:20, 08:31).
• Sagi claims PHP powers approximately 70% of the web (7 out of 10 websites) (17:30).
• Sagi claims that developing end-to-end heap grooming and remote exploits across versions like PHP 5.4 and PHP 8.5 traditionally takes a human researcher months, but AI sub-agents generated working exploits across both environments in a couple of weeks (18:50, 19:30).
• Thai claims coordinated daily syncs were held between PHP Foundation maintainers, OpenAI, Calif, Wiz, Linux distributions, WAF vendors, and hyperscale cloud providers prior to patch release (25:28, 26:17).

Notable quotes

• [00:06] “I was amazed by the capabilities of frontier model doing memory corruption exploitation... I did not expect that.” — Sagi Tzadik
• [19:09] “With AI you spawn two sub-agents, and you get the same exploit for both versions of PHP... this blows my mind.” — Sagi Tzadik
• [20:25] “Our engineer, he came up with this term like ‘agentic exploit development’... you basically build an exploit for a target, and then you do it in your lab... and then you deploy it against a real target over the internet.” — Thai Duong

Assessment
This is an authentic technical interview and podcast discussion between security researchers who co-discovered and coordinated disclosure for a major software vulnerability. The video consists entirely of a multi-party video call discussion without live screen captures of exploit payloads or terminal output.

Described by gemini-3.8-flash on 2026-10-22 from the video’s audio and frames.