On October 21, 2026, the open-source PHP project alongside the PHP Foundation simultaneously issued security updates covering PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This emergency release addresses two critical security vulnerabilities that allow unauthenticated attackers to execute arbitrary remote code (RCE) on web servers.
The U.S. National Security Agency (NSA) alongside cybersecurity centers across the United Kingdom, Singapore, and the European Union swiftly issued red alerts. Authorities advised administrators who cannot update immediately to temporarily disconnect their servers from the Internet to prevent potential compromise.
Two core vulnerabilities stem from memory management and error handling
The two vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, both received a risk score of 9.2 on the CVSS v4.0 scale. Both flaws lie deep within core components that virtually every web processing request must pass through: the memory allocation mechanism and the system error handling routine.
Among them, CVE-2026-109618 originates from an Out-of-Memory (OOM) error. When a request hits the memory limit at a sensitive moment, PHP leaves behind partially initialized data and treats it as valid data in subsequent tasks, leading to memory corruption. The second flaw, CVE-2026-109619, involves persistent global state lingering after a critical error, causing subsequent execution flows to reuse already freed memory regions (use-after-free).
Notably, signs of the OOM flaw were discovered back in 2024 during an independent security audit. However, the development team initially faced an impasse because technical solutions risked breaking backward compatibility or degrading performance across the third-party extension ecosystem. By August 2026, security firm Calif, in collaboration with OpenAI’s Patch the Planet program and Google’s Wiz research team, independently demonstrated practical RCE exploit scenarios on Apache servers utilizing mod_php and PHP-FPM environments.
Information leak forces development team to advance release schedule
The PHP Foundation’s original plan was to coordinate disclosure on October 22, 2026, giving operating system distributors and hosting providers sufficient time to prepare packages. However, on the afternoon of October 20, 2026, the identifiers for the two vulnerabilities began circulating on online forums accompanied by false claims of a maximum 10.0 risk score.
The situation escalated when an attack test video from a partner was accidentally leaked, and secure container image provider Chainguard unilaterally shipped patches more than 6 hours ahead of the scheduled time. Faced with the risk of hackers reverse-engineering binaries to craft widespread exploit code, the development team decided to push the official announcement forward by one day.
The incident illustrates the dual-edged nature of artificial intelligence in modern cybersecurity: large language models help researchers uncover vulnerabilities that have remained deeply hidden for decades across core libraries, while simultaneously shrinking the time required for malicious actors to generate automated exploit tools. The pressure now falls on the tens of millions of websites powered by PHP worldwide, as the window between patch availability and widespread exploitation narrows by the hour.