PHP fixes two remote code execution flaws after AI-assisted research

The PHP advisory identifies the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, and says both can enable remote code execution without authentication.[3] One flaw is tied to out-of-memory corruption; the other to stale global state.[3] OpenAI says the flaws are in PHP itself rather than in applications built on the language.[2] The distinction matters for triage: teams should check their PHP runtime, not only review individual PHP applications.[2]

PHP says installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.[3] PHP considers the risk highest for mod_php, where it demonstrated that an unauthenticated request could trigger an attack before application code runs.[3] Wiz says every PHP version released in the last decade is affected by at least one of the two vulnerabilities, reaching back to version 5.4.[4] Wiz also demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla deployments.[4]

PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; its advisory is dated 21 October 2026.[3] The PHP team urged all users to update immediately and said updating is the only safe choice because there are no complete mitigations.[3] OpenAI says sites using PHP can also apply mitigations from security vendors.[1] For administrators, the advisory makes upgrading the central response, rather than relying on a workaround alone.[3]

OpenAI says it led a two-month coalition of maintainers, researchers and security providers to prepare fixes and protections before disclosure.[1] It says PHP maintainers led the fixes and release, with Wiz and Cloudflare contributing research, technical support and coordination.[2] OpenAI says Calif identified a critical flaw using GPT-5.6 Sol as part of Patch the Planet, while Wiz independently discovered and reported both PHP vulnerabilities.[2] Wiz says frontier models helped researchers develop and adapt working exploits across multiple applications in hours.[4]