By Roman Aglaganov
On 21 October the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. They let an attacker run code on a server without logging in. Within hours, cyber-security agencies in several countries were telling organisations that could not update to take their sites offline.
What is wrong
Both bugs are in PHP itself, not in the apps built with it. They come from how PHP handles fatal errors, especially running out of memory, while it processes a request: the crash can leave stale internal state behind, and a later request on the same worker can reuse it. Wiz, one of the security firms that found them, says that can leak memory holding passwords, tokens and keys, or be chained into full remote code execution. It demonstrated attacks on WordPress, Drupal and Joomla, and says every PHP version of the last decade, back to 5.4, is affected by at least one of the flaws.
PHP says the fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older no longer get official updates, although the project published minimal patches for 7.4, 8.0 and 8.1 for people who build PHP themselves.
Where AI came in
The flaws were found by researchers at Calif and Wiz, the BBC reported. Calif and the PHP Foundation were part of Patch the Planet, an OpenAI programme that gives defenders access to its advanced models to find and fix flaws. Wiz says the bugs had been present for years, but proving they could be exploited took a chain of steps “at the edge of what human researchers could practically achieve”, and frontier models lowered that barrier. Wiz called the findings among the most severe vulnerabilities ever found in PHP.
The plan was to publish the details later in the month, alongside a complete fix. Details leaked on social media the day before, the BBC reported, forcing the announcement forward.
The scramble
Finland temporarily shut the government’s public web services, and the Netherlands’ cyber-security agency took its own website offline. The US National Security Agency, the UK’s National Cyber Security Centre and agencies in the EU, Australia and Japan urged patching, and said systems that could not be fixed quickly should be taken down. The Wikimedia Foundation took some systems down as a precaution. Cloudflare’s chief technology officer said it was already seeing early attacks.
Why it matters
This is the scenario security researchers have been warning about: AI makes finding serious bugs much faster, for defenders and attackers alike. Here, the defenders got there first and the fix shipped before attacks spread. But the hardest part is still human and slow. Organisations have to find every place PHP is running, including inside products that do not advertise it, and update each one.
