Two Critical PHP Flaws Put Web Servers in an Emergency Patch Race

PHP’s maintainers have released emergency fixes for two critical flaws that can let an unauthenticated attacker run code on a vulnerable web server. The October 21 release triggered rapid patching and precautionary shutdowns because PHP sits underneath a large share of public websites and many administrators may not realize that a product bundles it.

Key fact: PHP says all installations serving web requests are at risk and that updating is the only complete remedy.

Two bugs with one dangerous outcome

The first flaw, CVE-2026-109618, involves PHP’s handling of an out-of-memory condition. An interruption can leave internal request data only partly initialized, after which cleanup code may treat invalid data as legitimate. The second, CVE-2026-109619, involves internal state that can remain after its backing memory has been freed and later be reused by another request.

Both weaknesses can lead to remote code execution without authentication. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the affected ways of serving web requests, with the demonstrated risk highest for mod_php. Changing error-display settings does not address the underlying memory and state-management problems.

Why websites disappeared

European cybersecurity authorities advised organizations to identify PHP-based applications, prioritize internet-facing systems and apply the fixed packages. If immediate remediation was impossible, they recommended isolating exposed applications from public networks. Government portals and other organizations in several countries temporarily took services offline while administrators assessed and patched them.

This response was not evidence that every unavailable site had been compromised. Many shutdowns were precautionary. Reuters reported that Amazon observed attempts against decoy systems before public disclosure and later described the flaws as broadly exploited, but the company also said it was unclear whether the early attempts would have succeeded against real websites.

AI found the flaws, then shortened the response window

Calif used GPT-5.6 Sol to identify one flaw, while Wiz independently reported both after using its Atlas research system and models from Google and OpenAI. The groups coordinated with PHP maintainers and infrastructure providers before disclosure. OpenAI describes this as a “defender’s window”: capable models found the weaknesses early enough for patches and protections to be prepared.

The same automation changes the defensive timetable once technical details or a patch become public. Attackers can compare patched and unpatched code, generate test cases and scan exposed systems more quickly. The story is therefore not simply that AI discovered a bug. It is that discovery, exploit development and remediation are all accelerating around foundational open-source software.

What administrators need to check next

PHP’s fixed upstream releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive upstream security updates, so organizations using them need a supported distribution or long-term-support vendor backport, or must upgrade. Internet-facing systems deserve priority, followed by applications that hide PHP inside a commercial or open-source package.

The regulatory context is also changing. The European Union’s active-exploit reporting requirement began in September, as NewTqnia covered in the new 24-hour vulnerability-reporting rule. Separately, Spain’s first reported AI-agent-led breach showed why defenders must distinguish verified compromise from early allegations. For PHP operators, the immediate sequence is clearer: inventory, patch, validate the running version and investigate systems that may already have been exposed.