PHP project patches two critical remote-code-execution flaws that OpenAI and Wiz say were found with AI models

The PHP project’s security advisory, dated 21 October 2026, said PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.^[6] The advisory named them CVE-2026-109618, “RCE via OOM corruption”, and CVE-2026-109619, “RCE via stale global state”, and said all PHP installations serving web requests are at risk, with the risk highest for Apache with mod_php.^[6] The PHP Foundation said the actual severity score is CVSS 9.2.^[1] Wiz said PHP powers 70% of all websites in the world, and TechCrunch reported roughly 70%; they differ on how far back the affected versions go: Wiz says to PHP 5.4, and TechCrunch says since PHP 5, released in 2004.^[7][3] The PHP project said only an update is a complete solution, that PHP 8.1 and older no longer receive updates from the project, and that its security team provided minimal source backports for PHP 7.4, 8.0 and 8.1.^[6]

OpenAI said Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI’s Patch the Planet initiative, and that Wiz also independently discovered and reported both vulnerabilities.^[2] Wiz said it discovered the first vulnerability on 19 August 2026 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, reported them to the PHP security team on 24 August, and that PHP acknowledged the reports on 21 September.^[7] The PHP Foundation said Calif began an audit of PHP on 30 July 2026, that a Calif researcher reported an unconditional remote code execution on 11 August with the same root cause as a memory problem the Foundation had found in 2024, and that OpenAI independently reported the same root cause that day.^[1] The Foundation said AI helps its team validate reports, but that “a person makes every call and works on every patch”, and that the growth of AI-assisted research means the team gets far more reports than before: 15 CVEs published since 1 July and more than 100 reports that were invalid, duplicates or not reproducible.^[1]

The PHP Foundation said work on a fix for the 2024 finding had stalled and restarted repeatedly over months because each approach carried trade-offs such as compatibility breaks, new denial-of-service potential or changes to many third-party extensions, and called the delay “a structural failure” of its security team’s decision process and resources.^[1] The Foundation said the two CVE IDs began circulating on online forums and social media on Tuesday 20 October at around 15:00 UTC with a wrong release time and a wrong score of 10.0, and that PHP brought its pre-announcement forward to 19:30 UTC and moved the release from 22 October at 14:00 UTC to 21 October at 14:00 UTC.^[1] The Foundation said that Calif then mistakenly published a video of its proof of concept, which was later deleted, and that Chainguard, a distributor that had received the patch in advance, published built images containing the fix at 07:41 UTC on 21 October, more than six hours before the coordinated release.^[1]

OpenAI said it engaged parts of the US government including the White House’s Super Intelligence Force, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners, proposed a five-stage framework for responding to critical vulnerabilities and expects similar findings “to increase sharply in the coming months”.^[2] The Decoder reported that the fix was coordinated over two months in five phases, and TechCrunch reported that the US National Security Agency warned on Wednesday that a website that cannot be patched immediately should be taken off the web until it can be.^[4][3] TechCrunch reported that WordPress said the flaw is not WordPress-specific and that sites using its software must patch their servers with their hosting companies.^[3]

Wiz said it demonstrated unauthenticated remote code execution on the latest container images of WordPress, Drupal and Joomla, said exploitation does not depend on a flaw in an application’s own code, and wrote that “LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts”.^[7] OpenAI said the same capabilities that find vulnerabilities can also help attackers rapidly develop offensive tools and exploits.^[2] The PHP Foundation said it monitored proof-of-concept exploits that appeared after the leak and “did not identify any functional exploits” at the time of release.^[1] In a blog post dated 21 October 2026, Elias Taylor wrote that the public proof-of-concept exploits on GitHub do not work against a vanilla PHP instance, and that the vulnerability is nowhere near as easy to exploit as Log4Shell or Heartbleed, and that most of the public exploits lean on local file inclusion, a separate weakness the target server would need to have.^[5] TechCrunch reported that OpenAI says researchers found the flaws before attackers did, and wrote that there were therefore no reports of exploits in the wild; OpenAI’s own post says “to our knowledge” frontier AI found them before attackers did.^[3][2]