Emergency PHP patches released after AI found two critical remote code execution flaws

PHP is one of the most widely deployed server side languages on the web. W3Techs puts it at 69.3% of websites whose server side language is known, and WordPress, Drupal, Joomla, Laravel and Magento run on it. That reach turned a routine security release on October 21, 2026 into a global operational event. The PHP development team published versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2.

The path to disclosure was unusual. The Independent reported on October 22, 2026 that the flaw was discovered in August by Ryan Austin, a researcher at cybersecurity company Calif, using an advanced AI model developed by OpenAI. The UK National Cyber Security Centre said it had carried out a coordinated disclosure process after the flaw was identified months earlier. Its chief technology officer, Ollie Whitehouse, described the scale as unprecedented and warned it would likely not be the last such case.

Once the advisory went live, organisations did not wait for exploitation to be confirmed. Reuters reported on October 22, 2026 that governments in Europe and elsewhere took websites offline as a precaution while operators scrambled to secure systems. Germany's ITZBund took several sites offline. France's Interior Ministry took down prefecture websites. Belgium's foreign ministry took its sites offline. In the Netherlands, the Port of Rotterdam, Overheid.nl, the KNVB football association, the five largest political parties and numerous hospital websites were taken offline preventively. Finland's Valtori shut down government public web services, and the Czech government took its site offline at 7 p.m.

The interruption was not always caused by a confirmed breach. Reuters reported on October 22, 2026 that hacking attempts surged into the millions after disclosure, according to Cloudflare. Cloudflare chief executive Matthew Prince said the firm spotted hundreds of thousands of attempts within two hours of the announcement, with millions ongoing. Tenable reported on October 21, 2026 that Amazon Threat Intelligence observed an exploitation attempt on October 17, 2026, four days before public disclosure, against its MadPot honeypot network.

Key Facts

CVE-2026-109618 is an out of memory corruption flaw. PHP.net reported on October 21, 2026 that out of memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat invalid data as valid. CVE-2026-109619 is a stale global state flaw. Request owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it. Both allow unauthenticated remote code execution.

The affected surface is broad. PHP said all installations serving web requests are at risk, including PHP FPM, Apache with mod_php, php cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where a demonstrated exploit can trigger the attack before any application code runs. That matters because the vulnerable layer sits beneath WordPress, Drupal, Joomla, Laravel and Magento, so a plugin patch does not address the core flaw.

PHP said there are no complete mitigations and updating is the only safe choice. It published minimal source backports for PHP 7.4, 8.0 and 8.1 because those branches are end of life. Official releases cover only supported PHP 8.x branches, and PHP 8.2 reaches end of life on December 31, 2026. Interim measures include setting memory_limit=-1 in a way applications cannot override for CVE-2026-109618, and setting session.upload_progress.enabled=0 plus fatal_error_backtraces=0 on PHP 8.5 for CVE-2026-109619, then restarting every worker.

Exposure estimates varied but were consistently large. Tenable reported on October 21, 2026 that researcher Silas Cutler roughly estimated more than 1.3 million internet exposed hosts were potentially vulnerable, while a Shodan search by Henk Poley counted more than 1.9 million internet exposed hosts running PHP. Censys estimated that about 1.5 million of 2.6 million PHP hosts were running an unfixed version. Calif said it confirmed pre authentication remote code execution against specific versions of WordPress, Drupal, Joomla and Magento.

The UK alert added a clear operational test. The National Cyber Security Centre reported on October 21, 2026 that organisations using any version of PHP are affected and all are highly encouraged to update to the latest fixed version. It told defenders to identify systems running PHP, prioritise internet facing systems, avoid limiting discovery to outdated versions, apply temporary mitigations only when updating is impossible, and consider taking a system offline if mitigations cannot be applied in time. It also advised assessing systems for evidence of compromise and backdoors.

Analysis

The first lesson is that AI assisted vulnerability discovery has changed the tempo of disclosure. The Independent reported on October 22, 2026 that the flaw was found in August by a Calif researcher using an OpenAI model, and that the NCSC was briefed by OpenAI the previous week. That gave governments and large vendors a head start, but it did not give the long tail of PHP users the same advantage. When the advisory landed, small sites, agencies and regional operators had to absorb a critical core patch with little warning.

The second lesson is structural. PHP is shared plumbing for public services, banks, airlines, rail operators and tax systems, and the emergency shutdowns from Tokyo to Helsinki showed how quickly a language level flaw becomes an availability event. The bigger picture here is that dependency concentration has outgrown the patch model. A single set of releases on October 21, 2026 forced countries to choose between running unpatched web services and turning them off. Both choices carry costs, and neither is confined to the organisation that made the decision.

The third lesson is that stopgap controls have limits. Cloudflare deployed WAF rules for known exploit vectors to all customers including the free tier, but its CTO Dane Knecht described them as a stopgap only. WAF rules can block known patterns, yet the underlying bug is in request handling inside PHP, and PHP itself said there are no complete mitigations. What this really means is that perimeter filtering buys time, not immunity.

The fourth lesson is about end of life software. The PHP project published minimal source backports for PHP 7.4, 8.0 and 8.1 because those branches are end of life, but official releases stop at 8.2 and above. Tenable said the release was originally scheduled for October 22 and was moved up a day after the CVE identifiers leaked, while the PHP Foundation said the identifiers that circulated before the release carried an incorrect CVSS score of 10.0. The correction to 9.2 changes the number, not the reality of unauthenticated remote code execution in a core web language.

Why It Matters

The immediate impact fell on public services. Reuters reported on October 22, 2026 that banking, airline, rail, tax and government services were affected by emergency shutdowns from Tokyo to Helsinki. In the UK, 32 government services were offline and four partially unavailable, tech minister Baroness Lloyd of Effra told the House of Lords. Downing Street said no large UK public facing critical services had been affected, but some limited government websites went dark while issues were resolved, and stressed this did not mean they were hacked.

The security consequences extend beyond the outage window. The NCSC said attackers could trigger an out of memory condition that results in memory corruption, and under certain conditions that corruption could be exploited for unauthenticated remote code execution. Former GCHQ chief Sir David Omand warned that Russia and China, as well as criminal gangs, would be exploiting the bug. Many exploitation attempts were spotted within hours of the announcement, according to Amazon and Cloudflare. Once a core language bug is public, every exposed host becomes part of a global scanning contest.

The institutional consequences are about trust. Valtori Director General Hannu Naumanen said restoring services can take days or even weeks because systems need careful testing. That is a corrective to the idea that patching is a single command. Large estates have dependencies, change control and verification burdens. The fact that organisations chose precautionary shutdowns over continued operation shows that the cost of uncertainty can exceed the cost of downtime.

Next Up

The next phase is a long tail of patching and verification. Finland's Valtori said it had continued installing patches overnight and was gradually lifting precautionary service blocks. Several Asian governments ordered cybersecurity inspections, and China's industry ministry urged organisations to inspect systems immediately and upgrade to the latest secure PHP version. Tencent Cloud urged customers to install updated PHP versions but stopped short of calling for widespread shutdowns. The UK NCSC advised organisations to assess systems for evidence of compromise and backdoors.

PHP 8.2 reaches end of life on December 31, 2026, so administrators still on that branch have a second deadline close behind the emergency patch. The PHP project's backports for PHP 7.4, 8.0 and 8.1 are minimal source patches, not full supported releases. The practical agenda is to inventory PHP, prioritise internet facing systems, patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart workers, and then hunt for signs of compromise. The NCSC's Ollie Whitehouse warned that the scale was unprecedented and likely not the last.