One of the technologies that underpins much of the internet has needed some emergency fixing.
The PHP Foundation has shipped emergency security updates, patching two critical remote-code-execution vulnerabilities after details of the flaws leaked online two days before the planned release — forcing the team to move up its disclosure timeline by nearly a full day.
The releases — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — fix a pair of related bugs that could let an unauthenticated attacker run arbitrary code on servers running PHP, which still powers a large share of the web, including government portals, online stores, banks, and media sites. The Foundation is urging anyone running PHP to update immediately.
What went wrong
Both vulnerabilities trace back to parts of the PHP engine that almost every request passes through: memory management and error handling.
The first, tracked as CVE-2026-109618, is rooted in how PHP handles requests that hit its memory limit at an inopportune moment. Under the right conditions, this could corrupt memory in a way that let attackers achieve full remote code execution — demonstrated with default settings on Apache servers running mod_php, before any application code even runs. A separate code path allowed the same outcome on PHP-FPM setups.
The second, CVE-2026-109619, stems from a fatal error at the wrong point leaving the engine’s internal state pointing at memory that belonged to a previous request. A subsequent request handled by the same worker could then reuse that freed memory — a classic use-after-free bug that researchers turned into working remote code execution against a real production application.
Both flaws carry a CVSS score of 9.2, and both were rooted in the same underlying design issue inside PHP’s core.
A bug born in 2024, fixed under pressure in 2026
The story behind the fix stretches back two years. During PHP’s first external security audit in 2024 — funded by Germany’s Sovereign Tech Agency and carried out by Quarkslab — a contracted PHP core developer spotted early warning signs of the memory-corruption issue while patching something else. At the time, no one could find a concrete way to turn it into an exploit, so it sat behind other, more clearly dangerous bugs.
Attempts to fix it stalled for months afterward. The PHP security team, which works by consensus, went back and forth between several possible fixes, each with its own cost: breaking backward compatibility, opening up new denial-of-service risks, or requiring changes across a wide ecosystem of third-party extensions that would have been difficult to coordinate. The Foundation has openly described the resulting delay as a structural failure of both process and resources, and says it has since begun shifting toward majority-rule decisions rather than requiring full consensus.
Things changed in August 2026. As part of the Patch the Planet program, security firm Calif had begun auditing PHP in late July, and on August 11 a researcher there reported an unconditional remote-code-execution path tracing to the same root cause flagged back in 2024. OpenAI reported the identical issue independently on the same day, with Wiz and later OpenAI again contributing further attack vectors through September. That convergence of reports from multiple independent security teams made the real-world severity unmistakable, and fixing it became the Foundation’s top priority — with staff working weekends to coordinate a fix and manage disclosure with outside parties.
The leak, and a broken embargo
The coordinated disclosure process held together until two days before the planned release. On October 20, the two CVE identifiers began circulating on forums and social media, misquoted with the wrong release time and an inflated CVSS score of 10.0 (the real score is 9.2) — though no technical details leaked at that stage. PHP responded by pushing its pre-announcement forward and moving the release date up by a day, to October 21, to balance speed against giving distributors enough time to finish packaging updates.
The situation got messier hours later, when Calif — one of the firms that had reported the bugs — mistakenly published a demo video showing its proof-of-concept working against real targets, revealing a handful of additional details before it was taken down. Copies spread on social media anyway, accelerating outside attempts to build working exploits.
Separately, container-image provider Chainguard broke the coordinated embargo entirely, publishing patched images more than six hours ahead of the agreed release time — handing anyone willing to diff the binaries a working blueprint for the fix while the rest of the PHP ecosystem was still waiting.
AI is changing how PHP finds and triages bugs
The Foundation’s writeup also points to a broader shift underway in how it handles security work. Earlier in 2026, it partnered with Alpha-Omega to scan PHP’s codebase using Anthropic’s Claude Mythos. Since then, the team has added further tooling, including OpenAI’s Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments matched to PHP’s own CI across every platform it supports.
That tooling is arriving at a necessary moment: the Foundation says AI-assisted security research has sharply increased the volume of reports it receives, with the team publishing 15 CVEs and working through more than 100 invalid, duplicate, or non-reproducible reports since July 1 alone. AI tools now help triage and cluster reports that share a root cause, but the Foundation is clear that a human still makes every final call and writes every patch.
The ask: PHP security still runs on a small team
The Foundation’s broader message is about capacity. PHP sits underneath a huge portion of the internet’s infrastructure, yet the people fixing vulnerabilities in the language itself remain a small, mostly Foundation-funded group supplemented by volunteers. Automated tools can surface bugs faster than ever — for attackers and defenders alike — but deciding how to fix a problem embedded deep in decades-old design decisions still takes experienced engineers who understand the entire codebase, and the Foundation says there simply aren’t enough of them.
It’s now calling on companies that build on PHP, hosting providers and cloud platforms that distribute it, and governments whose public services depend on it to fund that work on an ongoing basis — pointing to the Sovereign Tech Agency’s funding of the 2024 audit as a model for what sustained public investment can achieve.