The PHP Foundation issued emergency security updates on October 21, 2026, to address two critical vulnerabilities that allow for unauthenticated remote code execution (RCE). The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS severity rating of 9.2 and affect the core architecture of PHP dating back to version 5.4, released in 2012.
The discovery of these “ancient” holes was the result of independent AI-driven research. OpenAI’s “Patch the Planet” initiative, utilizing the GPT-5.6 Sol model, and Google’s Wiz, using Gemini 4 Argon, identified the vulnerabilities that had escaped human audits for over two decades. Google completed its acquisition of Wiz for $32 billion in March 2026, integrating the firm’s scanning capabilities with its proprietary AI models.
The vulnerabilities stem from a failure in memory-limit handling and fatal error state management. Specifically, the technical mechanism involves PHP’s out-of-memory (OOM) handling and the use of longjmp(), which can leave the system in an unstable state that attackers can manipulate to execute arbitrary code. Roughly 70% of all websites on the internet utilize PHP, according to W3Techs data.
Global Response and Infrastructure Risks
The severity of the flaws has prompted a response from national security agencies. The NSA has urged all organizations using PHP to pull systems offline if they cannot patch them immediately.
The PHP Foundation has released the following patched versions to address the vulnerabilities:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The situation is more dire for legacy systems. Sites running PHP 8.1 or older are officially end-of-life and will not receive security updates. Operators of these systems must upgrade to a supported version or rely on vendor-specific backports. While WordPress itself is not the target of the vulnerability, the vast majority of WordPress installations are at risk at the server level because they rely on PHP to function.
The dual role of AI in this crisis highlights a new era in cybersecurity: while AI models like GPT-5.6 Sol are uncovering decades-old bugs, the same technology may enable more rapid, automated exploitation of the same flaws before organizations can secure their infrastructure.
