If your Web site runs PHP, update your servers now. That’s the upshot of two critical vulnerabilities that were discovered, with the help of AI, by the PHP Foundation. Fixes, in the form of software updates, were made available on October 21.
PHP, which originally stood for ‘Personal Home Page,’ but now is an acronym for ‘PHP: Hypertext Preprocessor,’ is a server-side scripting language used to develop Web sites and dynamic content. It is estimated that PHP runs on about 70% of all Web servers. Reuters estimated that about 40% of PHP sites run the Web site publishing tool WordPress.
The full back-story is posted on the PHP Foundation’s Web site, along with recommended remedies. That post explains how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP’s security work going.
What was it?
According to the PHP Foundation, the two remote code execution vulnerabilities were related (quoting):
- CVE-2026-109618 / GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (out-of-memory): If a request reached PHP’s memory_limit at exactly the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Remote code execution was also confirmed on PHP-FPM through application-level code paths.
- CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp: RCE via stale state: A fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request. A later request handled by the same worker could then use that freed memory. A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php.
“Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.”
The Out of Memory vulnerability had been detected in 2024 but was deemed to be low-risk at the time. The Remote Code Execution issue surfaced in August of this year, and had the same root cause.
The PHP Foundation is a non-profit organization formed in late 2021 to ensure the long-term sustainability, security, and prosperity of the PHP programming language.
How AI was involved
Earlier in 2026, the PHP Foundation created an Ecosystem Security Team, which works alongside the PHP security team on triage, coordination, and hardening. As part of that effort, that team worked with Alpha-Omega to scan PHP using Anthropic’s Claude Mythos AI model. Other models have also been used, to isolate root causes.
According to the PHP Foundation, “reports from fOpenAI, Calif, and Wiz, made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation’s team working on security … multiple people work(ed) on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties.”
Race against the clock
The PHP Foundation said that coordinated disclosure of these vulnerabilities to teams working on mitigating them worked well until 2 days ahead of the targeted release date.
On October 20th, the two vulnerabilities began circulating on online forums and social media. In response, the PHP project brought its pre-announcement forward by a day and released the security fixes on October 21st.
Why it matters
While this situation was not directly a case of “piracy” per se, an attack algorithm using these exploits could conceivably be embedded into apps distributed by illegal streaming services.
PHP Foundation said that “the growth of AI-assisted research means the PHP security team receives far more reports than before. As described in How the PHP Security Team Handles Your Reports, released in October 2026, the team has published 15 CVEs since July 1st and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible.
AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch.
Further reading
Today’s PHP Security Release and how we’re strengthening PHP security. Announcement / article. October 21, 2026. The PHP Foundation
Security advisory: Critical remote code execution vulnerabilities, update now (Announcing the availability of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. News archive. October 21, 2026. PHP.net
