> ## Content Index
> Fetch the complete content index at: https://theainewsfiles.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# PHP ships emergency fixes for two critical flaws as OpenAI and Wiz credit AI in their discovery
- URL: https://theainewsfiles.com/php-emergency-fixes-two-critical-flaws-cve-2026-109618-109619/
- Published: 2026-10-21T21:01:30.000Z
- Updated: 2026-10-21T21:01:30.000Z
- Description: PHP has released fixes for CVE-2026-109618 and CVE-2026-109619, two critical flaws rated CVSS 9.2. Sources differ on who found them first and on whether attacks are under way.
- Author: J E Cowie
- Tags: News

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. The releases fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the project's advisory says can allow unauthenticated remote code execution. The PHP security team rated each 9.2 on CVSS v4.0, as php.net's advance notice of 20 October and SOCRadar's write-up both record.

Several sources call the pair "PHP2Shell". Wiz, watchTowr, SOCRadar and the Dutch NCSC's repository use the name. The project's own advisory simply says "two critical vulnerabilities".

## What the flaws are

According to php.net, CVE-2026-109618 comes from out-of-memory handling that can interrupt PHP while internal request data is only partly set up. Request cleanup may then treat that invalid data as valid. CVE-2026-109619 involves request-owned internal state that survives after its memory has been freed. A later request handled by the same worker may use that stale state before normal initialisation resets it.

The project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod\_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod\_php, where it describes a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs. CERT-EU, which published Security Advisory 2026-018 the same day, says the same.

Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to version 5.4\. Tenable reports that, according to Calif's technical write-up, the earliest affected code path Calif found dates to PHP 5.4.0.

## What to do

The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. PHP 8.1 and older no longer receive updates from the project. Because of the severity, the security team published minimal source backports for PHP 7.4, 8.0 and 8.1\. Some distributions and long-term-support vendors also provide backported fixes.

For those who cannot update at once, php.net lists configuration changes that reduce exposure to specific attack paths, such as setting `session.upload_progress.enabled=0` and restarting every worker. It stresses that they do not make an installation safe: "There are no complete mitigations, updating is the only safe choice." CERT-EU adds that organisations unable to patch immediately should consider isolating internet-facing applications from public networks.

The Dutch NCSC's repository notes that PHP is also embedded in appliances, network devices and management interfaces, where administrators may not be able to update PHP directly.

On scale, the sources give slightly different figures. Wiz says PHP powers 70% of all websites, and OpenAI says an estimated 70%. Tenable cites W3Techs at 69.3% of websites whose server-side language is known, and watchTowr gives 70.8%.

## The AI claims

OpenAI says in a post on X that its models "helped researchers—operating as part of our Patch the Planet initiative" discover the flaws. It says it led a coalition of maintainers, researchers and security providers for two months to prepare fixes, because the fix "required a major change to the PHP engine". OpenAI also says it considers the bug "one of the most impactful vulnerabilities in recent memory" and that "to our knowledge, frontier AI was able to find this vulnerability ahead of attackers".

Wiz makes a similar case. It says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout its research, and that "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit." Wiz also says a single researcher completed in a week what previously would have taken a world-class team months. Tenable reports that Calif and Wiz have both said they used AI models.

These are the accounts of the companies that built or used the tools. They are reported here as their claims.

## Who found it first is reported differently

The PHP Foundation's account is a timeline. In 2024, during the project's first external security audit in years, a PHP core developer contracted by the Foundation found the first signs of the out-of-memory problem. The Foundation says no concrete exploit vector was found then. It says the security team developed several competing fixes that each came with trade-offs, and that the team's consensus-based decision process, combined with the lack of a known path to remote code execution and a small, stretched team of core developers, caused work on a fix "to stall and restart repeatedly over months". Of that delay, it writes, "the delay was a structural failure".

The Foundation says Calif began an audit of PHP on 30 July 2026\. On 11 August a Calif researcher, Ryan A, reported unconditional remote code execution with the same root cause. OpenAI independently reported the same root cause the same day. The Foundation lists further attack vectors from Wiz on 24 August and from OpenAI on 18 September.

Wiz's own timeline says its research found the first PHP vulnerability on 19 August and reported to the PHP security team on 24 August.

## A leak, and a release moved forward

The PHP Foundation says coordinated disclosure went to plan until two days before the target date. On Tuesday 20 October, at around 15:00 UTC, the two CVE IDs began circulating online, with a wrong release time and a wrong CVSS score of 10.0\. The Foundation says the actual score is 9.2\. It says no technical details leaked.

In response, the project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from 22 October to 21 October, 14:00 UTC. The Foundation says Calif then mistakenly published a video showing its proof of concept working against a number of targets. At 07:41 UTC on 21 October, it says, Chainguard published built images containing the fix, more than six hours before the coordinated release.

The release time is itself recorded two ways. php.net's notice scheduled it for 14:00 UTC, while CERT-EU records the fixes as released at 13:30 UTC.

## Is it being exploited?

The sources disagree, and they were written at different times on 21 October.

- **watchTowr.** Its page, published at 14:19 UTC, says it is observing active exploitation attempts against both CVEs.
- **Cloudflare.** Tenable reports that Cloudflare sees early attacks emerging. It embeds a post from Cloudflare CTO Dane Knecht saying "We are seeing early attacks emerging and are updating mitigations as new vectors show up."
- **Other vendors.** SOCRadar writes that Aikido said exploitation had been reported in the wild, and that Patchstack said it had confirmed multiple active exploitation incidents. SOCRadar adds that neither had published technical details of the attacks.
- **PHP and CISA.** SOCRadar writes that, as of 21 October, PHP had not reported in-the-wild exploitation and the US Cybersecurity and Infrastructure Security Agency had not added either CVE to its Known Exploited Vulnerabilities catalogue.
- **CERT-EU.** It says technical details are being discussed publicly and initial proofs of concept have begun to circulate, which "raises the likelihood that attackers are already exploiting the vulnerabilities".
- **PHP Foundation.** It says the PHP security team inspected proofs of concept that appeared after the leak but "did not identify any functional exploits at the time of release/public disclosure".
- **Tenable.** It says it has not verified that any of the circulating exploit code works against either CVE.

My reading is that the facts here are firmer on the patch than on the story around it. The four fixed releases, the affected configurations and the advice to update match across PHP, CERT-EU, Tenable and watchTowr. Who found what first, how much AI contributed beyond what the firms themselves say, and whether attacks are under way come from accounts that do not match.

## Sources

CERT-EU (2026) 'Critical Vulnerabilities in PHP', Security Advisory 2026-018, CERT-EU, 21 October 2026, available at: [https://cert.europa.eu/publications/security-advisories/2026-018/](https://cert.europa.eu/publications/security-advisories/2026-018/?ref=theainewsfiles.com) (Accessed: 21 October 2026).

NCSC-NL (2026) 'php2shell vulnerabilities (CVE-2026-109618, CVE-2026-109619)', GitHub, readme last significant change 21 October 2026, available at: [https://github.com/NCSC-NL/php2shell](https://github.com/NCSC-NL/php2shell?ref=theainewsfiles.com) (Accessed: 21 October 2026).

OpenAI (2026) 'OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP', X, 21 October 2026, available at: [https://x.com/OpenAI/status/2112907856018309586](https://x.com/OpenAI/status/2112907856018309586?ref=theainewsfiles.com) (Accessed: 21 October 2026).

Ernalbant, Yağmur (2026) 'PHP2Shell: CVE-2026-109618 & CVE-2026-109619', SOCRadar, 21 October 2026, available at: [https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/](https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/?ref=theainewsfiles.com) (Accessed: 21 October 2026).

Narang, S. (2026) 'php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities', Tenable, 21 October 2026, available at: [https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=theainewsfiles.com) (Accessed: 21 October 2026).

The PHP Foundation (2026) 'Today's PHP Security Release, and How We're Strengthening PHP Security', The PHP Foundation, 21 October 2026, available at: [https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/?ref=theainewsfiles.com) (Accessed: 21 October 2026).

The PHP Group (2026) 'News Archive - 2026' (security advisory of 21 October 2026 and advance notice of 20 October 2026), PHP.net, available at: [https://www.php.net/archive/2026.php#2026-10-20-1](https://www.php.net/archive/2026.php?ref=theainewsfiles.com#2026-10-20-1) (Accessed: 21 October 2026).

watchTowr (2026) 'PHP Remote Code Execution ("PHP2Shell" CVE-2026-109618 & CVE-2026-109619)', watchTowr, 21 October 2026, available at: [https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/?ref=theainewsfiles.com) (Accessed: 21 October 2026).

Wiz Research (2026) 'PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet', Wiz, 21 October 2026, available at: [https://www.wiz.io/blog/php2shell-php-rce](https://www.wiz.io/blog/php2shell-php-rce?ref=theainewsfiles.com) (Accessed: 21 October 2026).

## Picture credits

- Top picture: PHP code on a screen. The two flaws fixed on 21 October 2026 sit in PHP itself, not in the applications built on it. Webysther, via Wikimedia Commons. [CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/?ref=theainewsfiles.com) ([source](https://commons.wikimedia.org/wiki/File:Webysther%5F20170211%5F-%5FPrint%5FMediaWiki%5FCode.png?ref=theainewsfiles.com))