PHP Patches Two Critical RCE Flaws Found with Frontier AI Models

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, security releases that fix two critical vulnerabilities that can allow unauthenticated remote code execution and that were discovered with frontier AI models. The coordinated disclosure spanned the PHP project, OpenAI, security research firm Calif, and cloud security company Wiz.

The Patched Releases

The PHP project’s security advisory states that the four releases fix CVE-2026-109618, described as remote code execution via out-of-memory corruption, and CVE-2026-109619, described as remote code execution via stale global state. An advance notice from the PHP security team on October 20, 2026 rated both vulnerabilities CVSS v4.0 9.2 and scheduled the release for 14:00 UTC on October 21.

All PHP installations serving web requests are at risk, the advisory states, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is considered highest for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request before any application code runs.

The project states there are no complete mitigations and that updating is the only safe choice, though it lists interim settings that reduce exposure to specific attack paths. Linux distributions and LTS vendors received the patches in advance. The PHP security team also provided minimal source backports for PHP 7.4, 8.0, and 8.1, which no longer receive updates, and noted that PHP 8.2 reaches end of life on December 31, 2026.

The Vulnerabilities and the Php2shell Exploit

Wiz Research’s technical disclosure describes CVE-2026-109618 as covering an upload-progress unserializer use-after-free and a remote process-memory disclosure, and CVE-2026-109619 as covering a fatal-error backtrace use-after-free and an OPcache type confusion. All are memory-safety issues that stem from how PHP handles fatal errors, particularly out-of-memory errors, while processing requests.

Wiz said every PHP version released in the last decade is affected by at least one of the vulnerabilities, going back to version 5.4. Calif reported that the earliest affected path it found dates to PHP 5.4.0 and that exploitation paths, which depend on the PHP version and SAPI, are always exploitable under default configurations.

Wiz combined the vulnerabilities into a single exploit script named php2shell and demonstrated unauthenticated remote code execution against the latest container images of WordPress, Drupal, and Joomla. Separately, it demonstrated application-agnostic disclosure of PHP worker memory that can contain passwords, authentication tokens, API keys, and certificates. Calif’s write-up reports confirmed pre-authentication remote code execution on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1, and WHMCS, and on arbitrary PHP scripts in some instances.

Wiz describes PHP as powering 70% of all websites, including WordPress, Joomla, Drupal, and Wikipedia’s MediaWiki, and ranks the findings among the most severe vulnerabilities discovered in PHP.

How Frontier AI Models Found the Flaws

OpenAI said that over the past two months it led a coalition of maintainers, researchers, and security providers to address the vulnerabilities, with Calif identifying a critical flaw using its GPT-5.6 Sol model as part of OpenAI’s Patch the Planet initiative and Wiz independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release.

The participants’ timelines show overlapping independent discoveries. The PHP Foundation records that Calif began its audit on July 30, 2026 and that Calif researcher Ryan A reported an unconditional remote code execution on August 11, 2026, with OpenAI independently reporting the same root cause the same day. Calif’s account dates its discovery to August 1, 2026, an RCE proof of concept shared with PHP on August 14, 2026, PHP’s confirmation on August 15, 2026, and a second bug reported on August 21, 2026.

Wiz reports discovering the first vulnerability on August 19, 2026 using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, confirming unauthenticated code execution against Drupal on August 20, 2026 and WordPress on August 21, and reporting the vulnerabilities to the PHP security team on August 24, 2026. OpenAI added further attack vectors on September 18, 2026, according to the Foundation, and PHP acknowledged the reports and began developing a coordinated fix on September 21, 2026, according to Wiz.

The underlying weakness has a long history. Calif recounts that Stefan Esser found the first PHP memory-limit remote vulnerability in 2004, that a bug describing an out-of-memory condition was reported to the project in 2020, and that a 2024 audit by OSTIF and Quarkslab rediscovered the issue without proving exploitation. The PHP Foundation wrote that the 2024 audit was funded by the Sovereign Tech Agency and that work on a fix stalled and restarted repeatedly over months: “We won’t pretend otherwise: the delay was a structural failure.”

OpenAI stated that, given the severity of the flaws and PHP’s widespread use, it considers this one of the most impactful security issues in recent memory, and said that to its knowledge frontier AI found the vulnerabilities before attackers did, opening what it calls a Defender’s Window. The company committed $1 billion in subsidized Daybreak access for frontline defenders and published a PHP version checker as a Codex skill in the openai/php2shell-checker GitHub repository.

A Leaked Disclosure and a Broken Embargo

The PHP Foundation reports that the coordinated disclosure held until two days before the targeted release date. At around 15:00 UTC on October 20, 2026, the two CVE IDs began circulating on online forums and social media with a wrong release time and a wrong CVSS score of 10.0, though no technical details leaked. The PHP project moved its pre-announcement to 19:30 UTC that day and shifted the release from October 22, 2026 to October 21, 2026 at 14:00 UTC, saying distributors were still packaging the fix.

Around 20:00 UTC on October 20, Calif mistakenly published a video showing its proof of concept working against a number of targets, and copies circulated and contributed to accelerated development of various proof-of-concept exploits on October 21, according to the Foundation. At 07:41 UTC on October 21, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix, the Foundation reports. The PHP security team monitored the proofs of concept that appeared after the leak but did not identify any functional exploits at the time of release and public disclosure.

Government Coordination and a Proposed Framework

OpenAI said it worked with partners to engage multiple parts of the U.S. government, including the White House’s Super Intelligence Force, the Office of the National Cyber Director, and the Cybersecurity and Infrastructure Security Agency, as well as international partners, to help security guidance reach critical organizations. Wiz said that prior to public disclosure it partnered with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel, and others to prepare customer guidance, detections, and out-of-the-box mitigations for organizations that cannot update immediately.

OpenAI also published a proposed five-stage framework for responding to critical vulnerabilities in widely used software: validating and fixing the upstream vulnerability, giving affected organizations time to act, coordinating with government partners, preparing updates across affected products, and publishing guidance once a patch is available. The company asked the security community for feedback on the approach.

The PHP Foundation, which created an Ecosystem Security Team in May 2026 and hired Alexandre Daubois in July 2026 and Daniel Scherzer in September 2026, said the team has published 15 CVEs since July 1, 2026 while working through more than 100 reports that proved invalid, duplicates, or not reproducible. It appealed for sponsorship from companies, hosting providers, cloud platforms, distributions, and governments whose services run on PHP.