Axios reported on October 22, 2026, that a potential attack involving PHP vulnerabilities had emerged on October 21 and that dozens of websites were temporarily taken offline. The PHP Foundation said it had not identified a functional exploit when PHP released fixes on October 21. The two flaws can allow remote code execution, which means making a server run code through a request, under qualifying conditions.
What the October 21 reports said
The PHP Foundation described a disclosure disrupted by leaked vulnerability identifiers and fixed binaries appearing before the coordinated release. It said the identifiers began circulating on October 20 and that Chainguard published fixed build images before PHP’s public release the next day.
Two vulnerabilities, two failure paths
PHP assigned both vulnerabilities a CVSS v4.0 severity score of 9.2. Their underlying flaws differ:
| Vulnerability | Mechanism | Described impact |
| CVE-2026-109618 | Out-of-memory corruption can leave request data partially initialized and treated as valid. | Remote code execution under qualifying conditions. Wiz also demonstrated remote process-memory disclosure. |
| CVE-2026-109619 | A fatal error can leave stale global state, allowing a later request handled by the same worker to reuse freed memory. | Remote code execution under qualifying conditions. |
PHP says all installations serving web requests are in scope and identifies Apache’s mod_php as the highest-risk setup. Wiz says vulnerable versions extend back to PHP 5.4. PHP 8.1 and older no longer receive updates from the PHP project, although some vendors provide backports.
Researchers used AI; PHP maintainers made the fixes
The research involved people and AI tools. OpenAI says Calif identified a critical flaw using GPT-5.6 Sol. Wiz independently discovered and reported both vulnerabilities, while PHP maintainers led the fixes. The PHP Foundation says a PHP core developer had noticed signs of the out-of-memory flaw in 2024.
PHP released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The official PHP security notice says updating is the only complete remediation; configuration changes address specific attack paths but do not make an installation safe. NeoTeo covered the release in its earlier article on the PHP fixes.
