PHP Vulnerabilities Explained: How AI Found Two Critical Flaws Hiding in the Web’s Most Common Language

Published October 22, 2026

The short answer: Two critical PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker execute code on servers running unpatched PHP. The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 right now, and the U.S. National Security Agency says a site that cannot be patched immediately should come offline until it can be.

PHP quietly powers roughly 70% of the websites on the internet, so this is not a niche developer problem. It is an internet-scale one, and it carries a twist: AI found these flaws before attackers did, and AI is also the reason they are dangerous.

Key Facts at a Glance

• What happened: The PHP project shipped emergency security releases on October 21, 2026, fixing two critical PHP vulnerabilities that allow remote code execution in the PHP engine itself.
• Severity: CVSS 9.2, according to the PHP Foundation.
• Who is exposed: Servers running PHP, including sites built on WordPress, Drupal, Joomla, and MediaWiki, because the bugs live below the application layer.
• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Who found them: Security firm Calif (using OpenAI’s GPT-5.6 Sol) and Google’s Wiz (using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol). OpenAI independently reported the same root cause as Calif.
• Exploited in the wild? Not at the time of release, per the PHP project and OpenAI, though proof-of-concept code began circulating after a disclosure leak.
• Nickname: Wiz calls the exploit chain “PHP2Shell.”

What Are the Newly Disclosed PHP Vulnerabilities?

Definition: Memory-Safety Flaws in PHP’s Core Engine

The newly disclosed PHP vulnerabilities are memory-safety bugs in how the PHP engine handles fatal errors, especially out-of-memory (OOM) errors, while processing web requests. When a request dies at exactly the wrong moment, PHP can leave corrupted internal state behind. A later request handled by the same worker can then reuse that stale state, which opens the door to memory disclosure or memory corruption.

In plain terms, the bug is not in your website’s code. It is in the language runtime your website runs on. According to Wiz, even a bare “Hello World” application on an affected PHP version can be vulnerable.

CVE-2026-109618: Remote Code Execution via Out-of-Memory Corruption

The PHP Foundation describes CVE-2026-109618 as remote code execution (RCE) via OOM corruption. If a request reaches PHP’s memory_limit at precisely the wrong moment, PHP can leave partially initialized data behind and later treat it as valid. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.

Wiz ties this CVE to two concrete bugs. The first is a use-after-free in the upload-progress unserializer. The second is a remote process-memory disclosure that works even when an application never calls session_start(). The disclosure bug can leak live worker memory, which may hold passwords, tokens, API keys, and certificates belonging to other requests.

CVE-2026-109619: Remote Code Execution via Stale State

CVE-2026-109619 covers a related pattern. A fatal error at the wrong point can leave internal state pointing at memory that belonged to a previous request, and a later request on the same worker can then use that freed memory. Wiz grouped two bugs under this CVE: a use-after-free tied to the fatal-error backtrace, and a type confusion in OPcache. Wiz demonstrated unauthenticated remote code execution against Drupal and WordPress using these primitives.

Is This a WordPress Problem?

Not specifically. WordPress runs on PHP, but WordPress stated that the flaw is not WordPress-specific. Site owners running WordPress still need to patch their servers and work with their hosting companies, because the problem sits underneath the CMS.

How Serious Are These PHP Vulnerabilities?

Question: How bad is this, really?

Direct answer: Very. The PHP Foundation calls these PHP vulnerabilities critical, Wiz ranks them among the most severe ever found in PHP, and OpenAI says it considers them one of the most impactful security issues in recent memory. Unauthenticated remote code execution means an attacker needs no login to take control of a vulnerable server.

Three factors push the risk up:

• Reach: PHP powers roughly 70% of websites, and by some accounts more than 33 million sites.
• Age: TechCrunch reports the flaws have been present in every PHP version since PHP 5, released in 2004. Wiz says every release going back to PHP 5.4 is affected by at least one of the bugs.
• Position: Both flaws sit in memory management and error handling, which nearly every request touches. That is also why they were so hard to fix without breaking compatibility or third-party extensions.

Question: Why does the NSA say to take sites offline?

Direct answer: Because disclosure started a race. Now that the details are public, attackers know where to look, and tens of millions of sites still need patching. Pulling an unpatchable site offline removes it from the race.

Which PHP Versions Are Affected, and What Should You Run?

The PHP project released fixes for the PHP vulnerabilities across its supported branches. PHP 8.1 and older are no longer supported, so those servers need a full version upgrade rather than a point update.

PHP Branch	Status	Fixed In	What To Do
8.5	Current	8.5.12	Update to 8.5.12
8.4	Fix released	8.4.27	Update to 8.4.27
8.3	Fix released	8.3.36	Update to 8.3.36
8.2	Fix released	8.2.35	Update to 8.2.35
8.1 and older	No longer supported	No official fix	Upgrade to a supported branch, ideally 8.5.12

If you are unsure which version you run, OpenAI published a PHP version checker as a Codex skill that helps operators spot potentially vulnerable versions. Cross-check its output against php.net and your hosting provider’s guidance.

How AI Found Decades-Old Flaws

The Patch the Planet Route: Calif and OpenAI

OpenAI’s Patch the Planet initiative supports open-source maintainers with model access and security expertise. The PHP Foundation got PHP into the program, and Calif began auditing PHP on July 30, 2026. On August 11, Calif researcher Ryan A reported an unconditional remote code execution with the same root cause as an out-of-memory problem the PHP team had first spotted back in 2024. OpenAI independently reported the same root cause that day. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol.

The Wiz Route: Atlas, Gemini 4 Argon, and GPT-5.6 Sol

Separately, Wiz Research found its first PHP vulnerability on August 19, 2026, using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Within two days it had confirmed unauthenticated remote code execution against Drupal and then WordPress. Wiz reported its findings to the PHP security team on August 24. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, credited Gemini 4 Argon with helping defenders close a gap that left these flaws unaddressed for over a decade.

Why AI Changes the Economics of Exploitation

Question: If the bugs were old, why do they matter only now?

Direct answer: Because exploiting them used to be brutally hard. Turning the flaws into working attacks meant chaining several bugs and adapting to each target’s PHP version, configuration, and memory layout. Wiz explains that large language models can now help adapt an exploit to different versions and memory layouts, analyze failures, and iterate. By Wiz’s account, one researcher finished in about a week what would once have taken a world-class team months.

That is the central lesson of this story. These PHP vulnerabilities were found because of AI, and they are high risk largely because of AI. Complexity used to act as an informal shield. AI is wearing that shield down.

Timeline: From Discovery to Disclosure

Date	Event
2024	First external PHP security audit (Quarkslab, funded by the Sovereign Tech Agency via OSTIF). A core developer spots early signs of the OOM problem, but no concrete exploit path is found.
July 30, 2026	Calif begins a PHP audit under Patch the Planet.
August 11	Calif and OpenAI independently report the same root cause. Fixing it becomes the PHP security team’s top priority.
August 19	Wiz Research discovers its first PHP vulnerability.
August 24	Wiz reports its findings to PHP.
September 18	OpenAI reports further attack vectors.
September 21	PHP acknowledges Wiz’s reports and begins a coordinated fix.
October 20	The CVE IDs leak online around 15:00 UTC; PHP brings its pre-announcement and release forward.
October 21	Patched releases ship; Wiz, OpenAI, and the PHP Foundation publish details; the NSA issues its warning.

The Disclosure That Went Sideways

Coordinated disclosure worked well until two days before the planned release. According to the PHP Foundation, the two CVE IDs began circulating on forums and social media on October 20, with a wrong release time and a wrong CVSS score of 10.0. The real score is 9.2. No technical details leaked at that point.

The PHP project responded by publishing its pre-announcement early and moving the release from October 22 to October 21. Then it got messier. Calif accidentally published a video showing its proof of concept working against several targets, which revealed limited extra detail and helped accelerate independent exploit development. On October 21 at 07:41 UTC, more than six hours before the coordinated release, Chainguard published built images containing the fix, which let anyone study the patch in binary form while other users waited. The PHP Foundation said that disregarded weeks of coordination.

The PHP security team monitored the proof-of-concept code that appeared and reported no functional exploits at the time of release. Even so, the window defenders had is narrower than anyone planned.

What To Do Now: A Practical Checklist

For site owners, developers, and IT teams, the response to these PHP vulnerabilities is simple to describe and urgent to carry out:

• Check your version. Run php -v on each server, or ask your host. Do not assume managed hosting has already patched.
• Update to a fixed release. Target PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you run 8.1 or older, plan an upgrade to a supported branch.
• Ask your hosting provider. Shared and managed hosts control the PHP runtime. Get confirmation that the patched version is live.
• Restart workers. Make sure PHP-FPM or Apache processes are running the updated binaries, not stale ones.
• Use interim protections if you cannot patch yet. According to Wiz, providers including Cloudflare, Fastly, Google Cloud, and Vercel have published guidance and mitigations. OpenAI cautions that interim measures have limits and trade-offs.
• Take unpatchable sites offline. This is the NSA’s guidance for sites that cannot be fixed immediately.
• Hunt for signs of compromise. Patching closes the door; it does not tell you whether someone already walked through.

How To Spot Exploitation Attempts

Wiz notes that these issues execute below the application layer, so application logs may carry little context. Until you patch, watch for:

• Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses
• Unexpectedly large or malformed PHPSESSID response cookies
• Unexplained PHP worker churn, meaning workers crashing and restarting

Treat these as investigative leads, not proof. Wiz is explicit that applying the PHP security update is the only complete remediation. OpenAI also points operators to CISA’s guidance on prioritizing security updates by risk, and suggests forensic triage where compromise is plausible.

How Do These PHP Vulnerabilities Compare to Heartbleed and Log4Shell?

Wiz argues that PHP2Shell could mark a turning point for the AI era, as two earlier incidents did for their own. The comparison below reflects Wiz’s framing, not an independent ranking.

Incident	Year	What It Exposed	Why It Became a Turning Point
Heartbleed	2014	Fragility of shared infrastructure securing the internet	One flaw in a shared component rippled across the web
Log4Shell	2021	Deeply embedded dependencies organizations struggled to inventory	Hidden dependencies created widespread, hard-to-measure exposure
PHP2Shell	2026	Decades-old flaws in the engine behind about 70% of websites	AI changed the practical exploitability of long-standing bugs

The Bigger Story: Who Secures the Web’s Plumbing?

The PHP Foundation used the release to make a pointed argument. Security work on PHP still depends on a small group of foundation-funded developers and limited volunteer help, while AI tools multiply the number of incoming reports. Since July 1, the PHP security team has published 15 CVEs and worked through more than 100 reports that proved invalid, duplicate, or not reproducible. AI helps validate and group reports, but humans make every call and write every patch.

The Foundation was candid about its own shortcomings. It said the OOM problem lingered because competing fixes each carried trade-offs, its consensus-driven process stalled, and the team lacked resources. Since then it has added an Ecosystem Security Team (announced in May 2026), brought on more engineers, and expanded its AI-assisted tooling, including OpenAI’s Daybreak Red for validating reports and exploits. Earlier this year it also scanned PHP with Anthropic’s Claude Mythos, in work with Alpha-Omega.

The Foundation is asking three groups to step up: companies that build on PHP, hosting providers and cloud platforms that deliver it, and governments whose services depend on it. OpenAI, for its part, has committed $1 billion in subsidized Daybreak access for organizations with limited security resources, and it has proposed a five-stage response framework for critical vulnerabilities in widely used open-source software.

What Developers and Site Owners Should Take Away

These PHP vulnerabilities look like a preview of a pattern, not a one-off. OpenAI says it expects similar findings to increase sharply in the coming months. Three lessons from the PHP vulnerabilities stand out:

• Patch latency matters more. If AI shrinks the time between disclosure and working exploits, slow update cycles become the biggest risk.
• Know your runtime. Many teams track application dependencies carefully but overlook the interpreter underneath them.
• Unsupported versions are liabilities. PHP 8.1 and older receive no official fixes, so every new disclosure widens the gap.

Frequently Asked Questions

What are the CVE numbers for the new PHP vulnerabilities? CVE-2026-109618 and CVE-2026-109619, both critical remote code execution issues with a CVSS score of 9.2.

Which PHP version should I install? The current release is PHP 8.5.12. If you stay on an older supported branch, use 8.4.27, 8.3.36, or 8.2.35.

Can attackers exploit these flaws without logging in? Yes. The PHP Foundation says both allow an unauthenticated attacker to execute code under the right conditions.

Does updating WordPress fix the problem? No. The flaw is in PHP, not WordPress. You need to update PHP on the server, usually through your host.

Has anyone been hacked using these flaws? OpenAI says the flaws were found before attackers discovered them, and the PHP project saw no functional exploits at release. That could change quickly now that details and proof-of-concept code are circulating.

Who discovered the flaws? Calif, using OpenAI’s GPT-5.6 Sol under Patch the Planet, and Google’s Wiz, using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. OpenAI independently reported the same root cause as Calif.

The Bottom Line

The PHP vulnerabilities disclosed this week are serious, widespread, and fixable. The fix is a version update, and the deadline is effectively now. The deeper news is the shift they represent: AI found bugs that survived for more than a decade, and the same class of tools can turn such bugs into working attacks far faster than before. Update PHP, verify with your host, and treat patching as an urgent, recurring discipline rather than a quarterly chore.