The PHP project has released fixes for two critical vulnerabilities that can allow unauthenticated remote code execution on servers running PHP, after reports from security researchers and OpenAI that drew on AI models. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes, and the project urged all users to update immediately.

The flaws, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS 4.0 score of 9.2. The first involves PHP’s handling of out-of-memory conditions while internal request data is only partly initialized. In the second, internal state from one request can outlive its memory and be reused by a later request on the same worker.

PHP said all installations serving web requests are at risk, including PHP-FPM, php-cgi, FrankenPHP, LiteSpeed and Apache with mod_php. It rated the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.

PHP 8.1 and older no longer receive updates from the project, but its security team published minimal source backports for PHP 7.4, 8.0 and 8.1 given the severity. Linux distributions and long-term support vendors received the patches in advance.

OpenAI said security firm Calif identified a critical flaw using its GPT-5.6 Sol model through OpenAI’s Patch the Planet initiative, and that Wiz independently discovered and reported both vulnerabilities. OpenAI called the bugs “one of the most impactful security issues in recent memory” and said that, to its knowledge, frontier AI found them before attackers did.

The PHP Foundation said the root of the out-of-memory flaw had been spotted in 2024, when a developer fixing an issue from an external audit found the first signs of it. No concrete attack path emerged then, and work on a fix stalled and restarted repeatedly over months. The foundation called the delay “a structural failure” of the security team’s decision process and resources.

Calif began auditing PHP on July 30 under Patch the Planet. On August 11, it reported an unconditional remote code execution with the same root cause, and OpenAI independently reported the same root cause that day, according to the foundation. Wiz reported further attack paths on August 24, and OpenAI on September 18.

The coordinated disclosure worked well until two days before the planned release, the foundation said. On October 20, the CVE identifiers began circulating online with an incorrect CVSS score of 10.0, though no technical details leaked. PHP moved the release forward by a day to 14:00 UTC on October 21. Calif then mistakenly published a video showing its proof of concept, which the foundation said contributed to faster development of proof-of-concept exploits. The PHP security team did not identify functional exploits at the time of release.

The foundation also said Chainguard published built images containing the fix more than six hours before the coordinated release, breaking the embargo.

OpenAI said it coordinated with the White House’s Super Intelligence Force, the Office of the National Cyber Director and CISA, and committed $1 billion in subsidized access to its Daybreak security tools for organizations with limited security resources. It said it expects similar findings “to increase sharply in the coming months.” The PHP Foundation said its security team has published 15 CVEs since July 1 and worked through more than 100 reports that proved invalid, duplicated or not reproducible. Google paused product reports to its open-source bug bounty on October 1 after a surge in automated submissions.

PHP listed interim configuration changes for administrators who cannot update immediately. Those measures reduce exposure to specific attack paths “but do not make an installation safe,” the project said.

Sources: PHP, PHP Foundation, OpenAI

–
By the Control Plane Editorial Team