On October 21, 2026, the PHP project released security updates for two critical remote code execution flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. OpenAI's Patch the Planet effort and Wiz Research both say AI-assisted work helped find and demonstrate the bugs; PHP maintainers led the fixes after a multi-party coordinated disclosure.
Key Facts
| Details | |
|---|---|
| CVEs | CVE-2026-109618 (RCE via out-of-memory / OOM corruption); CVE-2026-109619 (RCE via stale global state) |
| Severity | CVSS 9.2, according to the PHP Foundation (a pre-disclosure leak wrongly listed 10.0) |
| Patched versions | PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released about 14:00 UTC on October 21, 2026 |
| Scope | Flaws sit in core PHP memory and fatal-error handling, not in a single application. Wiz demonstrated unauthenticated RCE against WordPress, Drupal and Joomla containers and application-agnostic process-memory disclosure |
| Who found what | Calif, working under OpenAI's Patch the Planet program, reported an RCE path with GPT-5.6 Sol. Wiz Research independently found and reported related issues using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. The PHP Foundation also describes earlier internal OOM concerns from 2024 |
| Remediation | Upgrading to a patched release is the only complete fix. Configuration workarounds (such as forcing memory_limit=-1) are incomplete |
Background
Wiz's public timeline says researchers confirmed unauthenticated RCE against Drupal on August 20 and WordPress on August 21, 2026, after discovering the first issue on August 19, then reported to PHP on August 24. PHP acknowledged the reports on September 21 and shipped patches with public disclosure on October 21. OpenAI says Calif identified a critical flaw with GPT-5.6 Sol as part of Patch the Planet, and that Wiz independently discovered and reported both vulnerabilities; partners including Cloudflare helped prepare protections ahead of disclosure.
The PHP Foundation blog fills in more of the disclosure stress: CVE IDs began circulating online around 15:00 UTC on October 20 with a wrong release time and a wrong CVSS of 10.0. PHP moved its pre-announcement earlier and advanced the release from October 22, 14:00 UTC to October 21, 14:00 UTC. Calif then mistakenly published a proof-of-concept video that was deleted but recopied; Chainguard published fixed images before the embargo lift on October 21 at 07:41 UTC. Simon Willison linked the Foundation post and stressed that PHP 8.x operators should upgrade quickly because exploit material spread after the leak.
Wiz brands the exploit chain "PHP2Shell" and writes that PHP powers about 70% of websites. TechCrunch repeats a similar "roughly 70%" figure. Those numbers reflect common web-technology surveys cited by the researchers, not a fresh census in the disclosure posts.
Reactions and Impact
OpenAI published a broader "Patch the Planet" coordination write-up, a Codex skill to help operators check PHP versions, and a separate $1 billion commitment in subsidized Daybreak access for frontline defenders. Wiz published technical detail on the four bug instances grouped under the two CVEs and listed cloud and CDN partners that prepared interim mitigations.
TechCrunch reported that the U.S. NSA warned operators that if a site cannot be patched immediately, it should be taken offline until it can. That guidance comes via TechCrunch's reporting of the NSA warning, not from OpenAI's or Wiz's primary posts.
What We Don't Know Yet
- How widely functional public exploits are being used against unpatched servers after disclosure.
- How quickly hosting providers and EOL PHP 5.4–8.1 fleets will finish migrations; AWS notes no upstream fix for those EOL branches.
- Whether additional engine variants beyond the patched root cause will surface.