Critical vulnerabilities in PHP fixed, discovered by AI models

Researchers from Wiz Research, OpenAI Codex Security, and Calif, as part of the Patch the Planet initiative, found two critical memory vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) that allow an unauthenticated attacker to execute remote code or read process memory. On October 21, the PHP team released emergency updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Compiled by Sergey KostenchukPublished 2026-10-22Updated 2026-10-22

2026-10-22 Safety OpenAI

🛡 Critical vulnerabilities in PHP fixed, discovered by AI models

Wiz Research, OpenAI Codex Security, and Calif found two critical memory vulnerabilities in the PHP core (CVE-2026-109618 and -109619, CVSS 9.2): unauthenticated RCE or process memory read. The bugs have existed since PHP 5.4 and affect approximately 70% of websites, including WordPress, Drupal, and Joomla. Emergency updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35 were released on October 21.

🌍 First major precedent: AI models Gemini 4 and GPT-5.6-Sol, working with experts, found a hole older than ten years in the most widely used server-side language; the Patch the Planet scheme may become standard for disclosing AI findings in open-source.

👤 PHP administrators and developers: immediately update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart workers. The php2shell-checker from OpenAI on GitHub helps check versions.

Source 1: https://www.php.net/archive/2026.php#2026-10-21-5 Source 2: https://php2shell.com/

Sources