Overview
- Researchers using both human analysis and advanced AI models found two critical PHP engine flaws that allow unauthenticated remote code execution, with proofs of concept circulating before full remediation was available.
- The PHP project published emergency fixes for supported branches on October 21, 2026 and urged immediate updates because there are no complete workarounds at the application layer.
- Security firms and providers reported millions of automated probes and exploit attempts within hours of public disclosure, though the PHP Foundation says it has not confirmed widespread successful compromises so far.
- Organisations are advised to inventory every PHP instance, prioritize internet‑facing and end‑of‑life deployments for patching or isolation, and run forensic checks for signs of pre‑patch intrusion such as unusual processes, file changes, or unexpected network connections.
- The episode highlights a larger shift: AI tools can speed turning long‑standing engine bugs into practical exploits, increasing pressure on under‑resourced teams and making faster patching, monitoring, and incident response essential to limit damage.