PHP ships emergency patches for critical flaws found with AI models

PHP released emergency updates on 21 October 2026 that fix two critical flaws letting unauthenticated attackers run code on web servers [2][3]. Security firms Calif and Wiz found the bugs with help from AI models, and OpenAI, which also reported them, coordinated the disclosure through its Patch the Planet programme [1][2][4].

Who has to patch, and which versions?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. The PHP project says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with the highest risk on mod_php [2][3].

Linux distributions and long-term-support vendors received the patches in advance, so most operators should take the update from their vendor [3]. PHP 8.1 and older no longer get official updates; the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 [3].

Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to PHP 5.4 [4]. PHP lists interim measures, such as removing the memory limit, but says only an update is a complete solution [3].

How did AI models find bugs that were more than a decade old?

Both flaws sit in PHP's memory management and error handling: an out-of-memory error at the wrong moment can leave stale internal state that a later request reuses [2][4]. The PHP Foundation says a core developer saw first signs of the problem in 2024, but work on a fix stalled for months, which it calls a structural failure [2].

Security firm Calif began auditing PHP on 30 July under Patch the Planet and reported remote code execution on 11 August; OpenAI independently reported the same root cause that day, and Wiz followed on 24 August [2]. Calif found one of the flaws with OpenAI's GPT-5.6 Sol, and Wiz independently reported both vulnerabilities. Wiz says it used its Wiz Atlas agent, Gemini 4 Argon and GPT-5.6 Sol [4].

Wiz says its combined exploit ran code without authentication on the latest WordPress, Drupal and Joomla container images, and could read passwords, tokens and API keys from server memory [4].

Why did the release come a day early?

The two CVE IDs began circulating online around 15:00 UTC on 20 October, with a wrong severity score of 10.0, according to the PHP Foundation [2]. PHP moved the release from 22 October to 21 October at 14:00 UTC, which was 16:00 in Berlin [2][7].

The Foundation says Calif mistakenly published a video of its proof of concept, and that Chainguard broke the embargo by publishing fixed images at 07:41 UTC, more than six hours early [2]. The PHP security team says it found no functional exploits at the time of release [2].

The Dutch NCSC took its own website offline as a precaution before the patches were released. It told organisations to weigh switching off internet-facing PHP systems until they are patched [5]. TechCrunch reported that the US National Security Agency gave similar advice, and BleepingComputer reported the same from the UK's NCSC [6][8].

What is OpenAI's Patch the Planet?

OpenAI calls the PHP flaws one of the most impactful security issues in recent memory and published a PHP version checker as a Codex skill [1]. It has committed $1 billion in subsidized access to Daybreak, its security tooling, for organisations with limited security resources [1].

OpenAI says it engaged US agencies including CISA and the Office of the National Cyber Director, and expects similar findings to increase sharply in the coming months [1].

Our read

Opinion: AI-assisted research found these bugs before attackers, but the leak and early images show that disclosure, not discovery, is now the weak link. Small maintainer teams need funding and process before the next wave of AI-found flaws arrives.

What we could not verify

• Whether any server was compromised through these flaws before or after the release.
• BleepingComputer's report that Cloudflare saw early attacks before the patch; we found no primary statement.
• The NSA warning reported by TechCrunch; we did not see the NSA's own text.
• Technical claims in unofficial third-party proof-of-concept write-ups circulating after the leak.