PHP ships fixes for AI-found flaws: patch today

If your site runs on PHP, this is your morning. Update it before you read the rest of the five.

The PHP project shipped security releases on October 21 for two critical flaws that let an attacker run code on a server without logging in. Wiz Research found them with help from AI models, and says every PHP version released in the last decade is affected by at least one of them.

Two flaws, a decade of exposure, and a fix

The PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on CVSS v4.0, according to php.net.

9.2 out of 10.

Both bugs live in how PHP cleans up after a fatal error, such as running out of memory mid request. Wiz's write-up, which calls the issue PHP2Shell, explains that a crash can leave broken internal state behind, and a later request on the same worker can then reuse it. That opens the door to reading the worker's memory or taking over the process.

Wiz says it demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla, using their latest container images. It also says exploitation "does not depend on a flaw in the application's code." A clean app on a vulnerable PHP build is still exposed.

Leaked worker memory can hold passwords, tokens and API keys, according to Wiz.

AI found it, and that is the part that should keep you up

Wiz credits its own Wiz Atlas tool plus two frontier models, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, with the find. It says Gemini 4 Argon also helped with exploit development and patch validation. The timeline on Wiz's page runs fast: first bug on August 19, a working takeover of Drupal the next day, WordPress the day after, a report to PHP on August 24, and public disclosure with patches on October 21.

Two days from the first bug to a WordPress takeover.

Yes, security researchers have always found old bugs. What changed is the speed and the depth: a memory bug in software Wiz says powers 70% of websites fell to a small research team with models doing the grinding. The same models are available to people who will not file a report. Assume the gap between disclosure and attack is shrinking, and the gap between patch and update has to shrink with it.

Full stop.

What to do this morning

Check your PHP version. Then move to a fixed release:

• PHP 8.5 to 8.5.12
• PHP 8.4 to 8.4.27
• PHP 8.3 to 8.3.36
• PHP 8.2 to 8.2.35

php.net lists fixes for those four branches only. If you are on 8.1 or older, the honest answer is an upgrade, not a patch. PHP 8.2 itself reaches end of life on December 31, 2026, per php.net.

The PHP advisory says "updating is the only safe choice" and that its interim settings, such as turning off session upload progress, "reduce exposure to specific attack paths but do not make an installation safe." Wiz thanks vendors including Cloudflare, Fastly and Vercel for mitigations that help anyone who cannot patch at once, and says the update remains the only complete fix.

On managed WordPress or shared hosting, ask your host which PHP build you are on today. Do not assume.

For your logs, Wiz suggests watching for odd multipart requests followed by memory limit errors, bursts of HTTP 500 responses, and oversized or malformed PHPSESSID cookies.

What to watch

Watch for reports of exploitation in the wild and for hosting providers confirming their rollouts. Then watch how fast the next AI-found bug of this size arrives.

Patch first. Read later.