PHP released a security patch on October 21, 2026 that fixes two critical remote code execution vulnerabilities in its core engine. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS 4.0 score of 9.2, placing them in the highest severity tier. Both flaws had been present in the codebase for more than a decade, affecting every PHP version released in the past ten years and extending back to version 5.4. Because PHP powers roughly 70 percent of all websites, the exposure reached the entire web infrastructure at once.
The vulnerabilities are memory-safety bugs triggered when PHP handles out-of-memory errors. One bug, an upload-progress unserializer use-after-free, leaves request memory uninitialized and allows attackers to reclaim it with malicious data. A second bug retains a backtrace pointer that points to freed memory after a fatal error, letting attackers corrupt shared state across worker requests. Wiz Research demonstrated unauthenticated remote code execution against WordPress, Drupal, and Joomla without exploiting any application-level flaw, because the bugs exist in the PHP engine itself.
The story matters now because governments and companies acted within hours, not weeks. Germany's ITZBund took federal websites offline as a preventive measure, while France's Interior Ministry temporarily shut down prefecture sites across the country. The Netherlands pulled the Port of Rotterdam, the government portal Overheid.nl, the national football association KNVB, and dozens of hospital sites. Finland's Valtori shut down all public web services, and the Czech government went dark at 7 p.m. on October 22. Japan's Ministry of Finance, Meteorological Agency, and National Tax Agency partially suspended online services, and major firms including Nomura, Mitsubishi UFJ, ANA, and East Japan Railway followed suit. The Wikimedia Foundation, which runs Wikipedia, took systems down, and the Internet Archive pulled its portal offline briefly.
The discovery itself is a turning point. Wiz Research found the first vulnerability on August 19 using a combination of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. They confirmed unauthenticated RCE against Drupal on August 20 and WordPress on August 21, then reported the issues to the PHP security team on August 24. The PHP team acknowledged the reports on September 21, and patched releases became available on October 21. Raluca Ada Popa, head of Gemini Security at Google DeepMind, said the team used Gemini 4 Argon because frontier AI reduced what previously required months of specialist work into a process completed in days.
It's not clear this will hold. The vulnerable code wasn't hidden; it was simply too complex for humans to exploit at scale before AI came along. Wiz notes that building reliable exploits required chaining multiple bugs, adapting to different memory layouts, and debugging failures across deployments. With AI, attackers can iterate faster than defenders can patch, which changes the economics of both discovery and exploitation.
Palo Alto Networks Unit 42 has identified over 22.6 million exposed instances that could be vulnerable to CVE-2026-109618 or CVE-2026-109619 based on telemetry. At least one European government website was taken offline as a precaution. The attack surface is enormous because every PHP server running unpatched versions is at risk regardless of the application layer, including simple static sites and major CMS platforms.
The attackers used AI too. Palo Alto Networks Unit 42 observed agentic AI platforms being used for post-exploitation activity against a government entity in Europe. Within two hours of initial exploitation, the attackers had accessed password hashes and multi-factor authentication secrets, established an NT LAN Manager relay tunnel into Active Directory, and attempted Domain Admin privilege escalation. The commands were wrapped in machine-parseable section delimiters such as ==SHELLUSER== and ==PASSWD==, clearly designed for AI consumption. Each batch was short and serially spaced, with quick pivots after failures, behavior markers that distinguish automated agents from human operators.
The PHP Foundation itself is under-funded, with only one full-time staff member directing the project, according to Reuters. That structural weakness makes coordinated patching harder when the core language of the web is under attack. Despite that, PHP did release fixes on October 21, and major vendors including Cloudflare, AWS, Google, Fastly, Akamai, Imperva, Vercel, and Automattic prepared out-of-the-box mitigations for customers unable to update immediately.
For defenders, Wiz recommends paying attention to unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unexpectedly large PHPSESSID cookies, and unexplained PHP worker churn until patches are applied. Applying the update remains the only complete fix, but the incident reveals a broader reality: AI does not just speed up defense, it accelerates offense too.
The PHP patch closes the core variants, but researchers note that other related flaws may exist in the codebase. The coordinated disclosure involved PHP, OpenAI, Calif, Automattic, and dozens of security vendors, yet 22.6 million exposed instances show the gap between patch availability and deployment still matters. Organizations that kept sites running without updates now face both the vulnerability and the possibility that AI-driven attackers will scale faster than manual response teams can react. For more on this story, see Reuters coverage, desk coverage, and related reports at /post/php2shell-analysis.
The industry now faces a simple fact: flaws that survived years of scrutiny became weaponizable in a week once AI entered the chain. Fixing PHP is a start, but the economics of this kind of discovery have changed permanently, and defenders will need to match that speed or accept that the next decade hidden bugs may not stay hidden for long.
Patch Gap
The patch released on October 21 closes the four primary memory-safety bugs grouped under the two CVEs. PHP versions 7.4.50, 8.0.30, 8.1.30, 8.2.25, 8.3.13, and 8.4.2 include the fixes, with the PHP team confirming every variant should fold under the same two CVEs. Sites that cannot update immediately can apply WAF rules from Cloudflare, Fastly, and Imperva, or enable request-size limits that block multipart uploads large enough to trigger the OOM conditions the exploit depends on.
Scaling Defense
The incident exposes a deeper vulnerability than any single code bug: the time between patch and deployment. Palo Alto Networks tracked 22.6 million PHP instances exposed to these CVEs, and attackers using AI-driven agentic platforms move through an environment in hours, not days. That window is now smaller than the time it takes most security teams to review a patch release.
Organizations that kept sites running without updates now face both the original vulnerability and the possibility that AI-driven attackers will scale faster than response teams can react. The next decade hidden flaws may not stay hidden for long once AI enters the discovery chain, and defenders will need to close the gap before it closes them.