What happened
- On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical remote code execution vulnerabilities.
- One, CVE-2026-109618, corrupts memory when a request hits the memory limit at the wrong moment; on Apache with mod_php an unauthenticated attacker can trigger it before application code runs. The other, CVE-2026-109619, reuses memory from a previous request after a fatal error.
- The PHP Foundation says the first sign of the memory problem appeared in 2024, during an external audit. The fix stalled for months.
- In 2026 the firm Calif, the Wiz team and OpenAI separately reported attack vectors. According to TechCrunch, they used AI models to find the flaws.
Why it matters
- PHP runs a huge part of the web, including WordPress. Anyone with a site on unsupported versions, 8.1 or earlier, must move to a supported branch and not just apply the patch.
- The Foundation calls its delay a “structural failure”: a consensus decision process with too few resources froze the fix until the Calif, OpenAI and Wiz reports showed the full impact. AI did not create the flaw: it sped up someone taking it seriously.
- For hosting providers and small businesses in Chile with PHP sites, the deadline is now: the patch is public and an attacker can compare it with the previous version.
The number
15 CVEs published by the PHP security team since July 1, driven by more AI-assisted reports.
Context
Calif began an audit of PHP on July 30, 2026 within OpenAI’s “Patch the Planet” program. On August 11 it reported an unconditional remote code execution with the same root cause as the 2024 problem. Wiz contributed vectors on August 24 and OpenAI on September 18. The Foundation created an Ecosystem Security Team in May.
What’s next
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch in use.
- The Foundation asks organizations that depend on PHP for sustained support to keep the security work going.
Bottom line
The year of critical flaws that force fast patching adds other cases: SGLang exposed remote code execution without a key, UpGuard found 16,326 open Supabase databases and ransomware operators are exploiting a GlobalProtect flaw.
Sources
- The PHP Foundation — Today’s PHP Security Release, and How We’re Strengthening PHP Security (October 21, 2026)
- PHP.net — PHP 8.5.12 Release Announcement
- TechCrunch — PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet (October 21, 2026; source for the use of AI in the discovery)
- Cover image: lmonk72, CC0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
