PHP fixes two critical RCE flaws found in Frontier AI

The PHP Project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, security releases that address two critical vulnerabilities that could allow unauthenticated remote code execution and that were discovered with frontier AI models. The coordinated disclosure included the PHP project, OpenAI, security research firm Calif, and cloud security firm Wiz.

The patched versions

The PHP Project Security Advisory states that the four releases address CVE-2026-109618, described as Remote Code Execution via Out of Memory Corruption, and CVE-2026-109619, described as Remote Code Execution via Deprecated Global State. An advance notice from the PHP Security Team on October 20, 2026 assessed both CVSS v4.0 9.2 vulnerabilities and scheduled the release for 2:00 PM UTC on October 21.

All PHP installations that serve web requests are at risk, the advisory states, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is considered highest for mod_php, where a demonstrated exploit can be triggered by an unauthenticated request prior to execution of application code.

The project states that there are no comprehensive mitigation measures and that updating is the only safe choice, although it lists temporary settings that reduce exposure to specific attack paths. Linux distributions and LTS vendors received patches early. The PHP Security Team also provided minimal source backports for PHP 7.4, 8.0, and 8.1, which are no longer receiving updates, and noted that PHP 8.2 will reach end-of-life on December 31, 2026.

Php2shell vulnerabilities and exploits

Wiz Research’s technical disclosure describes CVE-2026-109618 as a cover-up of a use-after-free load progress serializer and a remote process memory disclosure, and CVE-2026-109619 as a cover-up of a use-after-free backtrace fatal error and an OPcache type confusion. These are all memory safety issues that arise from the way PHP handles fatal errors, especially out-of-memory errors, when processing requests.

Wiz said that every version of PHP released over the past decade is affected by at least one of the vulnerabilities, starting with version 5.4. Calif reported that the first affected path found dates back to PHP 5.4.0 and that exploitation paths, which depend on the version of PHP and SAPI, are always exploitable with default configurations.

Wiz combined the vulnerabilities into a single exploit script called php2shell and demonstrated unauthenticated remote code execution against the latest WordPress, Drupal and Joomla container images. Separately, he demonstrated application-independent disclosure of PHP working memory that can contain passwords, authentication tokens, API keys, and certificates. Calif reports confirmed pre-authentication remote code execution on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1, and WHMCS and, in some cases, arbitrary PHP scripts.

Wiz describes PHP as powering 70% of all websites, including Wikipedia’s WordPress, Joomla, Drupal, and MediaWiki, and ranks the findings among the most serious vulnerabilities discovered in PHP.

How frontier AI models found flaws

OpenAI said it has led a coalition of maintainers, researchers and security vendors to address the vulnerabilities over the past two months, with Calif identifying a critical flaw using its GPT-5.6 Sol model as part of OpenAI’s Patch the Planet initiative and Wiz independently discovering and reporting both vulnerabilities. PHP maintainers led the fixes and release.

Participants’ timelines show overlapping independent findings. The PHP Foundation records that California began its audit on July 30, 2026, and that California researcher Ryan A reported unconditional remote code execution on August 11, 2026, with OpenAI independently reporting the same root cause on the same day. Calif’s account dates his discovery to August 1, 2026, an RCE proof of concept shared with PHP on August 14, 2026, PHP confirmation on August 15, 2026, and a second bug reported on August 21, 2026.

Wiz reports discovering the first vulnerability on August 19, 2026 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, confirming unauthenticated code execution against Drupal on August 20, 2026 and WordPress on August 21, and reporting the vulnerabilities to the PHP security team on August 24, 2026. OpenAI added additional attack vectors on September 18, 2026, according to the Foundation and PHP took note of the reports and began developing a coordinated solution on September 21, 2026, according to Wiz.

The underlying weakness has a long history. Calif reports that Stefan Esser found the first PHP remote memory limit vulnerability in 2004, that a bug describing an out-of-memory condition was reported to the project in 2020, and that a 2024 audit by OSTIF and Quarkslab rediscovered the issue without demonstrating exploitation. The PHP Foundation wrote that the 2024 audit was funded by the Sovereign Tech Agency and that work on a fix stalled and restarted repeatedly over months: “We won’t pretend otherwise: the delay was a structural failure.”

OpenAI said that given the severity of the flaws and the widespread use of PHP, it considers this one of the most impactful security issues in recent memory and said that, as far as it knows, frontier AI found the vulnerabilities before the attackers, opening what it calls a defender window. The company has set aside $1 billion to subsidize access to Daybreak for frontline defenders and has published a PHP version checker as a Codex competency in the openai/php2shell-checker GitHub repository.

A leaked disclosure and a broken embargo

The PHP Foundation reports that coordinated disclosure was maintained until two days before the expected release date. Around 15:00 UTC on October 20, 2026, the two CVE IDs began circulating on online forums and social media with an incorrect release time and an incorrect CVSS score of 10.0, although no technical details were leaked. The PHP Project moved its pre-announcement to 19:30 UTC that day and moved the release from October 22, 2026 to October 21, 2026 at 14:00 UTC, saying distributors were still packaging the fix.

Around 8pm UTC on October 20, California mistakenly posted a video showing its proof-of-concept working against a variety of targets, and copies circulated and helped accelerate the development of various proof-of-concept exploits on October 21, according to the Foundation. At 07:41 UTC on October 21, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and posted images containing the fix, the Foundation reports. The PHP security team monitored proofs of concept that appeared after the leak but did not identify any functional exploits at the time of release and public disclosure.

Government coordination and proposed framework

OpenAI said it has worked with partners to engage multiple parts of the U.S. government, including the White House Super Intelligence Force, the Office of the National Cyber Director, and the Cybersecurity and Infrastructure Security Agency, as well as international partners, to help security guidance reach critical organizations. Wiz said that ahead of the public disclosure it worked with Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and others to prepare ready-to-use customer guidance, detections and mitigations for organizations that can’t immediately upgrade.

OpenAI also published a proposed five-step framework for responding to critical vulnerabilities in widely used software: validate and patch the vulnerability upstream, give affected organizations time to act, coordinate with government partners, prepare updates for affected products, and publish guidance once a patch is available. The company asked the security community for feedback on the approach.

The PHP Foundation, which created an Ecosystem Security Team in May 2026 and hired Alexandre Daubois in July 2026 and Daniel Scherzer in September 2026, said the team has published 15 CVEs since July 1, 2026 while working on more than 100 reports that turned out to be invalid, duplicated or unreproducible. He appealed for sponsorship from companies, hosting providers, cloud platforms, distributions and governments whose services run on PHP.