Overview
- The PHP Foundation issued emergency patches on October 21 that fix two zero‑day RCE bugs tracked as CVE‑2026‑109618 and CVE‑2026‑109619 and released patched builds for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Both flaws were scored 9.2 under CVSS v4.0 and can allow unauthenticated attackers to run code on vulnerable servers, with reports noting versions back to PHP 5 may be affected and many unsupported releases cannot be patched.
- OpenAI’s Patch the Planet program helped coordinate discovery and pre‑disclosure remediation, with security firm Calif using GPT‑5.6 Sol to find one defect and Wiz independently reporting the other, and partners worked with PHP maintainers to verify fixes before publication.
- National CERTs and vendors urged urgent action and temporary takedowns where patching was not possible, and several consumer services and games temporarily limited features or paused logins while operators applied updates and pushed fixes to users.
- There is no public evidence of large‑scale exploitation so far, but authorities and firms continue active monitoring and warn operators to upgrade, isolate vulnerable hosts or disable risky features because PHP powers roughly 70% of websites and exposure remains high.