Two Critical PHP Flaws Rated 9.2 Reach Back to PHP 5.4, and AI Helped Find Them

News Summary

On October 21, 2026, the PHP project shipped emergency security releases for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution on servers handling web requests. The flaws sit in long-lived parts of the language runtime, were uncovered with help from advanced AI models, and affect a technology that powers a very large share of the web. TechCrunch published its report at 10:59 AM Pacific Time (PDT) the same day, and security researchers, cloud providers and hosting companies spent the day urging site operators to update.

What Was Found

According to PHP's advisory as relayed by Google Cloud, Patchstack and The Hacker News, both vulnerabilities carry a CVSS v4.0 score of 9.2, the Critical band. One is described as a memory-lifecycle bug, in which request-owned internal state can survive after the memory behind it has been freed. Wiz Research says at least one of the two issues affects every PHP version going back to 5.4, and TechCrunch notes the flaws have existed since the PHP 5 era, which began in 2004. Some coverage has given the pair the nickname "PHP2Shell". The flaws could let attackers reach a server's file system or a database used by a web application.

Who Discovered Them and How

OpenAI says it spent roughly two months leading a coalition of maintainers, researchers and security providers on the issue under its "Patch the Planet" initiative. The security testing firm Calif identified a critical flaw using OpenAI's GPT-5.6 Sol model, and OpenAI describes Wiz as having independently discovered and reported both vulnerabilities. One press account describes a timeline in which Calif found an early version of the bug in August, and a more complete version emerged in September.

Wiz, now part of Google, says its team combined its own Wiz Atlas security agent with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Wiz reports that these tools helped with finding the weakness, building proof-of-concept exploits, creating detection logic and validating the fix. Wiz demonstrated unauthenticated remote code execution against current container images of WordPress, Drupal and Joomla, and also showed that PHP worker memory, which can hold passwords, tokens and API keys, could be read. Reports differ on how autonomous the AI work was, and analysts note that the disclosures do not show every discovery was made by a model alone. Human researchers and PHP maintainers remained central to the effort.

The Fix and What to Do

Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all published on October 21, 2026. PHP 8.1 and older have reached end of life and will not receive fixes, so operators on those branches need to move to a supported version. PHP said all installations serving web requests are at risk, with the highest exposure in setups that use Apache's mod_php. Wiz says the patch addresses the underlying problem, including other variants.

The U.S. National Security Agency published an advisory titled "NSA Advisory: PHP Updates" on Wednesday, October 21, 2026. It recommended that any site that cannot be patched immediately be taken offline until protection is applied, and said more specific guidance would follow. CISA also issued an alert urging prompt patching. Because exact wording matters for compliance work, operators should read the original advisories directly.

How Big Is the Exposure

TechCrunch cites W3Techs data indicating PHP powers roughly 70% of websites with a detectable server-side language, and notes that some accounts put the number of affected sites at tens of millions. WordPress, which runs on PHP, says the issue is not specific to its software. Sites running the WordPress CMS must update their server's PHP runtime and coordinate with their hosting providers. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping with the response, and OpenAI also named Cloudflare among participants.

Exploitation Status

The picture is still evolving. OpenAI says its researchers found the flaws before attackers did, and CISA reported no observed exploitation at the time of its alert. Other reports describe early probing: Patchstack said its telemetry showed probing attempts with no hard evidence of breaches, and The Hacker News referred to exploit attempts emerging. Cloudflare said the same day that details had leaked and that attackers were targeting some of its customers. Readers should treat the situation as early-stage and assume unpatched servers are at risk now that the fixes are public.

Why It Matters for Science and Technology

The episode shows how modern AI models can read large, decades-old codebases and surface subtle memory-handling errors that human reviewers and traditional fuzzing missed. Wiz warned that AI also lowers the barrier for attackers, since language models can help adapt an exploit to different PHP versions, configurations and memory layouts. That makes coordinated, responsible disclosure, in which researchers work privately with maintainers on patches before going public, more important. OpenAI has proposed a five-stage framework for handling critical vulnerabilities in widely used software and released a PHP version checker as a Codex skill to help administrators find out whether they are exposed.

Practical Steps for Site Owners

Check the PHP version running on every server, container image and shared hosting plan. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch in use, and restart web servers and PHP workers so the new runtime is loaded. Move off PHP 8.1 and earlier. Where an immediate update is not possible, follow the NSA guidance and consider taking the site offline until it is patched. After updating, rotate credentials and API keys that may have been exposed in server memory, and review logs for unusual requests.