Two flaws in PHP’s core engine prompted emergency security updates on October 21, with researchers and cyber agencies warning that unpatched web servers could be compromised without a login.
The maintainers of PHP, the scripting language behind a large share of the web, released four emergency updates on Wednesday, October 21, 2026, to address two vulnerabilities capable of enabling unauthenticated remote code execution in affected configurations. The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 severity score of 9.2. The fixed upstream versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP project’s security notice is unambiguous: upgrading is the only complete remedy.
The important distinction is where the weaknesses sit. These are not newly discovered defects in a WordPress theme or an individual website’s business logic; they are problems in PHP’s underlying engine, which processes requests for many applications. That makes the response a responsibility shared by hosting companies, Linux distributors, application owners and operators of internet-facing infrastructure. In reporting on the disruption, Reuters and Associated Press described public websites being temporarily taken offline while fixes were assessed or installed.
What the two vulnerabilities actually do
CVE-2026-109618 concerns out-of-memory handling. When a request exhausts memory during a sensitive phase of initialization, PHP could exit abruptly while internal request data was only partly established. The subsequent cleanup could mistakenly operate on invalid state, creating opportunities for memory corruption. The maintainers’ technical advisory identifies a demonstrated remote-code-execution path on Apache with mod_php that can occur before an application executes its own code. Other execution environments, including PHP-FPM, have different lifecycles and exposure conditions; a demonstration for one configuration must not be read as proof of an identical attack path on every server.
CVE-2026-109619 involves stale global state retained by a worker between requests. In certain error and initialization sequences, PHP could continue to reference memory that a previous request had already released. A later request handled by the same process might then encounter a use-after-free condition. The second PHP advisory documents confirmed paths and the configurations that make them reachable. Neither CVE is a universal promise that any HTTP request immediately grants access; both are serious because researchers established exploitable conditions in widely deployed server arrangements.
A platform-level problem, not a CMS patch
Security researchers at Wiz say they demonstrated unauthenticated code execution on test deployments of WordPress, Drupal and Joomla, as well as memory disclosure in the PHP process. Those are research demonstrations, not evidence that all installations of those content-management systems have been breached. The applications served as examples of what might happen when a vulnerable PHP runtime is exposed beneath otherwise legitimate software.
The widely repeated claim that PHP powers roughly 70% of the web also needs care. It describes a broad measure of PHP usage, often among sites whose server-side language can be identified; it is not a verified count of exploitable servers. Exposure depends on the running PHP version, packaging, configuration, internet reachability and any vendor backports. Updating an application or its plugins does not, by itself, replace a vulnerable PHP interpreter installed by a hosting provider.
How AI changed the investigation
The research is notable partly because of the tools used to turn difficult memory-management weaknesses into convincing demonstrations. Wiz reports using Wiz Atlas alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol in its analysis, testing and patch validation. OpenAI says security firm Calif identified a critical flaw with help from GPT-5.6 Sol, while Wiz independently reported both issues. These are descriptions from the organizations involved, not a basis for claiming an AI system independently secured the internet.
The PHP Foundation’s account makes the chronology more complicated than a simple tale of machines discovering bugs that humans missed. Signs of the out-of-memory problem had emerged during security work in 2024, but maintainers lacked a clear practical exploitation path. Proposed repairs raised difficult compatibility, performance and extension-management questions; the foundation now characterizes the prolonged delay as a structural failure. Reports in August 2026 from Calif, OpenAI and Wiz made the consequences concrete and pushed a coordinated repair to the front of the queue.
That sequence illustrates a real change in security economics. AI-assisted analysis can help researchers work through large codebases, unusual failure conditions and repeated test cycles. It does not remove the need for specialists to validate the result, design an upstream fix, test regressions or decide when disclosure is safe. The maintainers, rather than the models, delivered the patches.
Disclosure, disruption and what is not yet established
The release followed an uneasy disclosure window. According to the PHP Foundation, CVE identifiers circulated online on October 20 with an incorrect score of 10.0; the official assessment is 9.2. It also describes the premature circulation of demonstration material and an early appearance of patched software from a distributor. That compressed the planned timetable for coordinated disclosure. The foundation says its team had not identified functioning attacks in the wild at the time of the public release; Reuters reported that CISA had likewise not observed exploitation when its guidance was issued.
Those statements are time-bound, not guarantees that exploitation cannot occur later. Circulating proofs of concept, laboratory exploitation and confirmed intrusions into unrelated organizations are three different categories of evidence. Public reports of precautionary government-site outages are also not proof that those sites were compromised. Keeping these distinctions intact matters when security teams have to prioritize urgent work without amplifying unverified claims.
The practical response for operators
The first task is to identify every runtime actually serving web traffic, including PHP bundled into appliances, managed services and legacy applications. Check the web-facing environment rather than relying only on a command-line version banner, then determine whether the installed build contains the official fix or a documented vendor backport. The PHP project says releases older than PHP 8.2 no longer receive normal upstream fixes, although some long-term-support vendors supply backported packages. Operators must confirm the position with their distributor instead of assuming that an unchanged version number means no patch exists.
Next, apply the relevant update, restart or recycle affected workers as advised by the provider, test essential application paths and watch service health and security telemetry. The joint statement from ENISA, CERT-EU and European partners recommends prioritising internet-facing applications and coordinating directly with hosting and service suppliers. Where patching is impossible at once, isolating exposed systems from public networks may be justified. The UK National Cyber Security Centre similarly advises considering temporary removal from service until remediation is possible.
Some configuration changes and network controls can reduce exposure to particular techniques, but the PHP project stresses that they do not close every route to the affected code. Web application firewalls, rate limits and monitoring are useful layers, not substitutes for a fixed engine. Teams investigating suspicious behavior should retain relevant logs and evidence, but avoid treating a single crash, malformed request or unusual upload as confirmation of a successful intrusion.
A wider test of software security governance
This episode brings together two realities that are likely to persist: increasingly capable discovery tools, and a complex ecosystem that still depends on small groups of maintainers to repair foundational software. Model-assisted research helped establish the impact of old defects; the public-interest outcome now depends on how reliably that knowledge turns into maintained packages on real systems. The essential question is not whether AI can produce another alarming demonstration, but whether developers, cloud providers and public agencies can shorten the interval between a validated finding and a verified fix running in production.
Primary documentation
For affected versions and full remediation guidance, consult the PHP project security advisory, its CVE-2026-109618 and CVE-2026-109619 technical records, the PHP Foundation’s disclosure timeline and the European agencies’ joint response.
