Critical PHP flaws allow attacks without login – update now

The PHP project released new versions on Wednesday, 21 October, fixing two critical vulnerabilities. According to PHP's own security advisory, the flaws can allow unauthenticated remote code execution. OpenAI says its models helped researchers find the flaws, and that it led a coalition that spent two months preparing the fix.

For organisations running websites and web applications, the message is simple: find out where you run PHP, and update now. The PHP team itself says updating is the only safe choice.

What PHP has fixed

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. In its advance notice the day before, the PHP team said both are rated 9.2 under CVSS v4.0, and that the release was scheduled for 14:00 UTC on Wednesday.

The first flaw concerns out-of-memory handling. PHP can be interrupted while internal request data is only partially initialised, and request cleanup may then treat the invalid data as valid. The second concerns request-owned internal state that survives after its backing memory has been freed, so a later request handled by the same worker may use it.

The PHP team says every PHP installation serving web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where the team has demonstrated an exploit in which an unauthenticated request can trigger the attack before any application code runs.

The PHP advisory does not say the flaws have been exploited in attacks. OpenAI writes that, to its knowledge, frontier AI found the vulnerabilities before attackers did.

Older versions and interim measures

PHP 8.1 and older no longer receive updates from the PHP project. Given the severity, the security team has still provided minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source or lack a long-term support vendor. Linux distributions and such vendors received the patches in advance, so PHP asks users to check their own vendor's packages.

The volunteer-maintained package source rpms.remirepo.net will not have updates on Wednesday, according to PHP. The team urges its users to switch to distribution packages or build from source.

If you cannot update immediately, PHP describes some settings that reduce exposure along specific attack paths. They include memory limit and request size settings, and disabling session.upload_progress. PHP stresses that these measures do not make an installation safe. PHP 8.2 also reaches end of life on 31 December 2026.

What OpenAI says about the discovery

OpenAI writes that the security firm Calif identified a critical flaw using its GPT-5.6 Sol model, as part of OpenAI's Patch the Planet initiative. The security firm Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes. OpenAI, Wiz, Cloudflare and others contributed research, technical support and coordination.

OpenAI calls this one of the most impactful security issues in recent memory. The company estimates that PHP runs around 70 percent of websites. That figure is OpenAI's own estimate.

The company is sharing a PHP version checker and says it will launch an accompanying Codex skill. OpenAI also says it has committed 1 billion dollars in subsidised access to its Daybreak security service for organisations with limited security resources that protect essential services. It expects similar findings to increase sharply in the coming months, and proposes a five-stage process for coordinating fixes before a vulnerability becomes public.

What leaders should do now

The first step is knowing where PHP runs. Many organisations have PHP in content management systems, online shops, customer portals and older line-of-business systems, often run by a hosting provider or a web agency. Ask for written confirmation of which versions are running, and when they were updated.

Prioritise internet-facing services, and especially Apache with mod_php, where PHP itself rates the risk highest. Interim settings can buy time, but they do not replace the update.

If you have systems on PHP 8.1 or older, this is a cost and risk question, not just an IT task. Find out whether your vendor offers fixes, or plan an upgrade. The same question applies to PHP 8.2 before the end of the year.

The case also shows how AI is changing the pace of security work. With OpenAI itself expecting more findings like this, organisations need a standing routine for fast security updates, with clear ownership internally and at their suppliers.

Sources and media

• PHP: Security advisory, Critical remote code execution vulnerabilities, published 21 October 2026, read 21 October 2026 at 14:07 UTC.
• OpenAI: Patch the Planet, global response coordination as agents uncover critical vulnerabilities, published 21 October 2026.
• OpenAI on X about the PHP vulnerabilities, published 21 October 2026 at 14:04 UTC.

Illustration: AI-generated with Grok Bot / hogby.ai