Wiz: "These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it"[1]

Calif: "the available exploitation paths depend on the PHP version and SAPI but are always exploitable under default configurations" ... "This results in RCE against arbitrary PHP scripts on Apache mod_php and PHP >= 5.4.0."[2]

PHP Foundation: "full remote code execution was demonstrated with default settings."[3]

Unless all of these organizations are lying, the exploit can work against a default PHP installation running a Hello World script.

[1] https://www.wiz.io/blog/php2shell-php-rce

[2] https://calif.io/php2shell/

[3] https://thephp.foundation/blog/2026/10/21/todays-php-securit...

The author isn't disputing that these organizations have developed working exploits, they're saying that the exploit is difficult enough to achieve that, as far as they can tell, nobody has publicly released a working exploit except for vibe coders whose exploits rely on insane misconfigurations on the server.

With previous showstopper security bugs, once you knew the vulnerability existed the exploit was immediately obvious.

At least with the PHP one they caveat this with "under the right conditions" which judging by what we know now, the right conditions are you've already exploited the server with a LFI