Overview
- PHP maintainers released emergency updates on October 21 that patch two remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS v4.0 scores of 9.2.
- The bugs are unauthenticated RCEs that stem from memory-corruption and use-after-free conditions and can let an attacker run arbitrary code, change site content, or seize servers.
- Fixed versions published include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 while older and end-of-life releases such as 8.1 and earlier may remain unpatched and pose remediation challenges.
- National CERTs and major vendors urged immediate upgrades and recommended that organizations unable to patch promptly consider taking affected sites offline and apply temporary network and credential mitigations.
- OpenAI led a coordinated, AI-assisted discovery and disclosure effort called Patch the Planet, published a PHP version-check tool and committed funding to help resource-limited operators, and officials say no large-scale public exploitation has been confirmed so far.