Two critical PHP security flaws could allow hackers to take control of vulnerable web servers without logging in. The vulnerabilities, rated 9.2 out of 10, prompted urgent warnings from European cybersecurity officials and forced website operators to prioritise emergency security updates.
The PHP development team released patches on October 21, 2026. Security officials are urging organisations to update immediately as technical details and proof-of-concept exploits become publicly available.
What Is PHP and Why Does It Matter?
PHP is an open-source programming language that runs on web servers. It processes requests, connects to databases and generates dynamic webpages before sending content to a visitor’s browser.
It powers major parts of the internet, including WordPress websites, online stores, blogs and business portals. Consequently, a vulnerability in PHP’s underlying engine can affect many different websites, even when they use different themes, plugins or applications.
The risk is particularly significant for website owners who rely on shared hosting and may not know which PHP version their server runs.
What Are the Two PHP Security Flaws?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 severity score of 9.2 and can potentially enable unauthenticated remote code execution (RCE).
Remote code execution means an attacker may be able to make a vulnerable server execute malicious commands over the internet without first obtaining a legitimate account.
According to CERT-EU’s technical advisory, the flaws involve two different programming errors:
- CVE-2026-109618: Memory corruption associated with PHP’s out-of-memory error handling.
- CVE-2026-109619: Stale internal state that can remain accessible after memory has been freed.
If exploited, these flaws could expose websites to data theft, malicious code, website defacement and potentially wider server compromise. The actual impact depends on the hosting configuration, permissions and other security controls.
A vulnerability does not mean every PHP website has been hacked. It means vulnerable installations face a serious risk that requires immediate remediation.
How Did AI Help Discover the Vulnerabilities?
The incident highlights the growing role of artificial intelligence in cybersecurity.
OpenAI’s October 21 announcement said security researchers at Calif identified a critical PHP flaw using its GPT-5.6 Sol model as part of the company’s Patch the Planet initiative. Security company Wiz independently discovered and reported vulnerabilities, while PHP maintainers and other industry partners coordinated the response.
The findings demonstrate how AI-assisted research can help uncover difficult software vulnerabilities. However, AI discovery is only one part of the process: human researchers, maintainers and security teams must still validate findings, develop fixes and coordinate responsible disclosure.
AI is increasingly a dual-use technology in cybersecurity. The same capabilities that help defenders identify weaknesses can also help attackers analyse software and develop exploits.
Which PHP Versions Need Updating?
PHP released the following security versions on October 21, 2026:
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Older branches, including PHP 8.1 and earlier, require particular attention because they no longer receive security updates from the PHP project. Website owners should consult their hosting provider for a supported upgrade path.
What Should WordPress Website Owners Do?
WordPress runs on PHP, but updating WordPress core or installing a security plugin does not necessarily update the PHP runtime on the server.
Website owners should:
- Contact their hosting provider or check the hosting control panel to identify the active PHP version.
- Upgrade to an appropriate fixed, supported PHP release.
- If an immediate update is impossible, ask the provider to isolate the vulnerable service or temporarily disable public access.
- Review server logs, investigate suspicious activity and check for unauthorised changes.
- Maintain tested backups and verify the website after patching.
CERT-EU warns that isolation may be necessary when immediate remediation is not possible. A firewall or security plugin should not be treated as a substitute for the official fix.
The Bigger Lesson: Software Security Is Now an AI-Era Priority
The PHP incident illustrates a growing challenge for the digital economy: a single weakness in widely deployed infrastructure can create risks across thousands or potentially millions of independent websites.
AI-assisted security research may help defenders find flaws faster, but it also increases the importance of rapid patching, coordinated disclosure and long-term maintenance of open-source software.
For website owners, the priority is straightforward: check the PHP version, install the appropriate security update and investigate any signs of compromise. The vulnerability has been patched upstream; leaving an exposed server unpatched is now an avoidable risk.
