The key facts
- Two PHP vulnerabilities rated 9.2/10 allow code execution without authorization; versions 5.4–8.5.11 affected
- Patches PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released on October 21; no full mitigations available
- Vulnerabilities found by AI tools (GPT-5.6 Sol at Calif, several tools at Wiz); Cloudflare reported attacks after details leaked
Critical vulnerabilities in PHP
Researchers have discovered two critical vulnerabilities in the PHP programming language, which powers millions of websites, including WordPress, Drupal, Joomla and MediaWiki (the software behind Wikipedia). According to W3Techs, PHP is used on roughly 69% of websites with a known server-side language. The vulnerabilities received the identifiers CVE-2026-109618 and CVE-2026-109619; Google Cloud's technical analysis rates each a critical 9.2 out of 10. Both relate to memory handling under certain error conditions: one concerns an out-of-memory state in which internal request data remains partially initialized, the other involves accessing memory after it has been freed. By sending specially crafted requests, an attacker can execute their own code on the server without logging in, allowing them to steal data, alter website content, or use the server to attack other systems.
Scale of the problem
Wiz reported that the vulnerabilities affect PHP versions starting from 5.4, released more than a decade ago; Google Cloud indicates a range from PHP 5.4 to 8.5.11, and Cloudflare confirmed the vulnerability of servers running PHP 5.4 and newer. This does not mean every site is compromised or that all configurations are equally easy to exploit: PHP developers stated that installations processing web requests are at risk, and some configurations are especially vulnerable. Since the language itself is affected, updating WordPress plugins and themes does not solve the problem — PHP itself must be updated.
Response and patches
PHP developers released four patched versions on Wednesday: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging all users to update immediately. They warned that 'there are no complete mitigations', meaning temporary workarounds do not replace installing the update. Cloudflare said it deployed web application firewall rules before the public disclosure. Agencies in the US, UK, EU and Australia issued urgent warnings: the US NSA advised updating systems or temporarily taking offline those that cannot be updated right away; the UK's NCSC gave similar recommendations, while EU bodies called for immediate patching with priority for internet-facing systems. Some organizations temporarily took sites offline as a precaution. New Zealand's NCSC reported on Thursday that it was aware of signs of active exploitation.
The role of AI and the details leak
The vulnerabilities were found by researchers from Calif and Wiz using AI. OpenAI said Calif discovered the critical vulnerability using the GPT-5.6 Sol model as part of a security initiative, while Wiz independently found the vulnerabilities using several AI tools. The code bugs themselves had existed for years, but demonstrating a real attack required detailed technical work: according to Wiz, one researcher accomplished it in about a week, whereas previously it could have taken a specialized team months. OpenAI called the finding 'one of the most significant security issues in recent times'. Researchers and PHP developers coordinated privately for several weeks, but details leaked shortly before the planned announcement. Cloudflare said that after this it recorded attack traffic against its customers and changes in attackers' tactics in attempts to bypass defenses.
Risks and recommendations
Experts warn that the same AI tools that helped defenders can also make exploiting vulnerabilities faster and cheaper for attackers: after disclosure, AI can help write exploits faster and adapt attacks, shrinking the so-called defender's window — the period between a vulnerability's discovery and its mass exploitation. Organizations are advised to identify PHP installations, immediately update them to patched versions, prioritize internet-facing systems, and monitor for signs of compromise; if rapid patching is not possible, temporarily take vulnerable services offline. Ordinary users cannot directly fix the vulnerability — responsibility lies with site operators and hosting providers; they are advised to watch for service notifications, change passwords as appropriate, and beware of phishing exploiting the incident's prominence.
