Critical PHP Vulnerabilities Put Websites at Risk as Emergency Patches Roll Out

Two critical PHP vulnerabilities disclosed on October 21 could allow attackers to execute code remotely on vulnerable servers, prompting urgent security warnings for website operators and technology providers worldwide.

The PHP vulnerabilities affect the core of the widely used server-side programming language, rather than a specific website or application. Researchers from OpenAI, Google and cybersecurity firm Wiz contributed to identifying and investigating the flaws with AI-assisted research. PHP maintainers have released security updates, but administrators must still ensure their systems are running patched versions.

The flaws carry a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System. Their potential impact includes unauthorised access to server processes and sensitive data, making prompt remediation a priority for organisations running PHP-based infrastructure.

PHP Vulnerabilities Expose Servers to Remote Attacks

The two flaws have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619. They stem from problems in how PHP handles memory and internal state during request processing, including situations involving memory exhaustion and incomplete cleanup.

One vulnerability can leave internal request data in an invalid state after an operation fails. The other can allow information associated with an earlier request to remain accessible after its memory has been released. Under certain conditions, attackers can exploit these weaknesses to execute code remotely without authenticating first.

Because the vulnerabilities exist in PHP itself, the risk is not limited to a particular content management system. Websites using platforms such as WordPress, Drupal and Joomla may also be exposed when their underlying PHP installations are vulnerable.

Which PHP Versions Need Updating?

The PHP project released fixes on October 21 for four supported branches:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

Installations running earlier versions in these branches should be upgraded to the corresponding patched release. The PHP project has not issued equivalent fixes for PHP 8.1 and earlier, which have reached end of life. Organisations using those versions need to migrate to a supported release rather than assume a routine update will resolve the problem.

Security teams should identify their deployed PHP versions, check how those runtimes are managed and confirm that updates have reached production. Updating a development environment or rebuilding an image alone does not guarantee that live services are protected.

AI-Assisted Research Brings Old Flaws to Light

The discovery also highlights how AI tools are changing vulnerability research. OpenAI said its researchers worked with software maintainers and security partners over two months to investigate the flaws and coordinate fixes before public disclosure. Wiz also reported independent discoveries, while Google described the role of its AI-assisted security research.

The vulnerabilities were not necessarily new in origin: the underlying weaknesses had persisted in PHP for years. AI-assisted analysis helped researchers understand how they could be triggered and demonstrate their security impact.

That creates both an opportunity and a challenge for defenders. AI can help uncover weaknesses that have escaped scrutiny, but similar capabilities could also help attackers develop exploits more quickly once technical details become public.

Why Immediate Patching Matters

The PHP vulnerabilities demonstrate how a flaw in a foundational software component can affect a broad range of websites and services. The US Cybersecurity and Infrastructure Security Agency urged organisations to update affected systems promptly. It said it had not observed exploitation at the time of its advisory, but warned that unpatched installations remained at risk.

For administrators, the priority is to apply the relevant fixes, verify the deployed versions and investigate suspicious activity where appropriate. With patches now public, organisations should not assume that systems are safe simply because no attack has been detected.