Overview
- The PHP Foundation released emergency fixes on Wednesday, publishing patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address CVE-2026-109618 and CVE-2026-109619.
- Security reports say one flaw is an out‑of‑memory or memory‑corruption bug and the other is a use‑after‑free error, and both can let an attacker run code on a server without logging in.
- Because roughly 70% of websites use PHP and many shared hosts and older CMS installs still run unsupported releases, operators may need to apply patches quickly or take sites offline temporarily.
- OpenAI’s Patch the Planet coordinated a roughly two‑month disclosure with security firms including Calif, which used GPT‑5.6 Sol, and Wiz to find, test and help prepare the fixes and published a PHP version checker and support resources.
- CERT‑EU, Australia’s ACSC and other national authorities urged immediate patching and stronger monitoring, and so far officials report no public evidence of widespread exploitation.