PHP5 min read

PHP patches two critical bugs, and the working exploits came from AI-assisted research

How widely the October 17 attempts succeeded is not in the PHP advisory. Datadog attributes the report of attempts…

Major
Primary

On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical bugs, CVE-2026-109618 and CVE-2026-109619. Each is scored 9.2. An unauthenticated request can run code on a server that is still on an older build.

At a glance

Versions and the affected server types are from PHP's October 21 advisory. The 5.4 through 8.5.11 range and the 9.2 scores are also stated by Google Cloud. Model names are from Wiz.
CVE-2026-109618	Out-of-memory handling can leave request data half initialized. Score 9.2.
CVE-2026-109619	State from one request can be reused by the next request on the same worker. Score 9.2.
Vulnerable range	PHP 5.4 through 8.5.11, as Google Cloud lists it
Patched releases	8.5.12, 8.4.27, 8.3.36, and 8.2.35
Highest risk	Apache with mod_php, before application code runs. PHP-FPM is also affected.
Older branches	8.1 and older are out of normal updates. Source backports exist for 7.4, 8.0, and 8.1.
Models named by Wiz	Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas
First working report	August 11, 2026, Calif, after a 2024 audit that had no remote path

How to read this claim

Measurement — How widely the October 17 attempts succeeded is not in the PHP advisory. Datadog attributes the report of attempts…
Bill — A score is not a price. If you will call a model next, list input and output per million tokens on the vendor page.
Door — Wiz's claim that one researcher did a week's work in place of months by a team is Wiz's judgment, not a timed public trial.

Keep the habit · field card with prices and worked checks

What changed

Supported PHP builds before October 21 can run an unauthenticated attacker's code when a request hits an out-of-memory failure or leaves stale state on a worker. The patched builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. What changed in the research, according to Wiz, is the time: a decade-old flaw became a working exploit in a week once frontier models were in the loop.

What it introduces

A coordinated engine fix for two memory-safety bugs, and a public case in which frontier models did the adaptation work that used to make this class of bug impractical.

Who benefits Anyone running PHP on a web request, including hosts of WordPress, Drupal, Joomla, and MediaWiki, and anyone who packages PHP inside an image that is not the system package.

Try this

Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or your distribution's package that contains those fixes, and restart every PHP worker. On 8.1 or older, use the vendor backport or move to a supported branch. Check images that bring their own PHP, not only the copy installed on the host. Treat a configuration tweak as a stopgap. PHP says it is not a complete fix. On October 23 PHP also asked operators to turn session upload progress off until the next bugfix release, for a narrower leftover path it scored as unlikely.

What we do not know

How widely the October 17 attempts succeeded is not in the PHP advisory. Datadog attributes the report of attempts to AWS.
Wiz's claim that one researcher did a week's work in place of months by a team is Wiz's judgment, not a timed public trial.
PHP says other variants of the same pattern exist. The project says the patch closes them in the releases named above. Builds that are not on those releases are outside that sentence.
The October 23 note, CVE-2026-115560, is a narrower leftover. PHP says a full advisory comes with the next bugfix release, and that the path needs an unusual configuration.

October 23

PHP asked operators to set session upload progress off until the next bugfix release. The note is a narrower path, CVE-2026-115560, which PHP says needs an unusual configuration. It is not a substitute for the October 21 update.

Evidence

Primary Security advisory. The versions, the scores, and the failure mode are from PHP's October 21 advisory. The discovery timeline is the PHP Foundation's. The model names are Wiz's. Datadog says it reproduced the bugs and that AWS reported attempts on October 17.

Independent Datadog says it reproduced both bugs. The October 17 exploitation attempts are Datadog's account of an AWS report, not a measurement made for this page. Wiz's week-versus-months comparison is Wiz's.

Sources

Security advisory Primary · October 21, 2026
PHP Foundation
Wiz
Datadog
Google Cloud

Still unclear? · Start here · ranks, prices, unknown How widely the October 17 attempts succeeded is not in the PHP advisory. Datadog attributes the report of attempts…

The record

What happened

On October 21, 2026, the PHP project shipped 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The advisory says the two bugs can allow unauthenticated remote code execution on PHP that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP says the risk is highest on mod_php, where a request can trigger the attack before any application code runs. CVE-2026-109618 is an out-of-memory failure that can leave request data only partly initialized, so later cleanup treats that data as valid. CVE-2026-109619 is state from one request that can still be used by a later request on the same worker after its memory has been freed. Google Cloud lists every version from 5.4 through 8.5.11 as vulnerable, and both flaws at CVSS 9.2. PHP 8.1 and older are outside the project's normal updates. The security team published minimal source backports for 7.4, 8.0, and 8.1. PHP says temporary configuration changes reduce some paths and do not make an installation safe.

Why it matters

The bug is not in WordPress or Drupal. It is in PHP, so a site whose own code is careful is still exposed if the interpreter is old. Wiz demonstrated code execution against current WordPress, Drupal, and Joomla images, and says a program that only prints a line can be enough, because the failure happens while PHP is still starting the request. The other half of the story is how the exploit became practical. The PHP Foundation says a 2024 audit saw the out-of-memory problem and did not find a concrete path to code execution. In 2026, Calif, OpenAI, and Wiz did. Wiz says Gemini 4 Argon, GPT-5.6 Sol, and its own Atlas system were used to find the bug, build the exploit, write detection, and check the patch, and that one researcher finished in a week a job that used to take a team months. That claim is Wiz's. The consequence it points at is not. A memory bug that was too tangled to weaponize is no longer protected by that tangle, for the people who report it or for the people who copy the result.

The PHP Foundation's timeline is more than one lab. A 2024 Quarkslab audit, funded through the Sovereign Tech Agency, surfaced the out-of-memory problem while another fix was in progress. No remote path was shown then, and the security team stalled for months on a fix that risked compatibility, a new denial of service, or changes across third-party extensions. Calif's audit started July 30, 2026. On August 11, Ryan A at Calif reported remote code execution with that same root cause. OpenAI reported the same root cause on its own, then more paths on September 18. Wiz reported on August 24. From August 11 the Foundation treated the fix as the top security job.

Wiz's account of the models is specific. The first issue in its timeline was found on August 19 with Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Unauthenticated code execution was then shown on Drupal on August 20 and on WordPress on August 21. Wiz says Argon contributed to finding the bug, developing the exploit, detecting the attack, and checking the patch. Google Cloud's note says the same about Argon. Wiz also says the practical change is adaptation: a working chain still has to be refit to each PHP version, configuration, and memory layout, and a model with a test loop can do that refit. That is the emerging threat in the post. Complexity stopped being a reliable delay.

The disclosure did not stay inside the embargo. The Foundation says that on October 20, around 15:00 UTC, the two CVE identifiers were already circulating, with a wrong release time and a wrong score of 10.0. The real score is 9.2. No technical write-up had leaked. PHP moved its pre-announcement to 19:30 UTC that day and moved the release from October 22 at 14:00 UTC to October 21 at 14:00 UTC, because distributors were still packaging the fix. A Calif video of a proof of concept then went out by mistake and copies spread. At 07:41 UTC on October 21, more than six hours before the coordinated release, Chainguard published images that contained the fix. The Foundation says that let someone study the patch in binary form while everyone else was still waiting. At the moment of release, the PHP security team said it had not yet identified a functional public exploit.

Datadog says it reproduced both bugs and confirmed that application login cannot sit in front of them, because PHP handles the request before the application runs. Datadog also says AWS reported exploitation attempts in the wild as early as October 17, four days before the public advisory. That sentence is Datadog's account of AWS. It is not a figure this page remeasured. Datadog agrees with PHP that the upload-progress setting is not a full defense against the two critical bugs.