News · 2026-10-22

PHP fixes two critical engine flaws after AI-assisted security research

PHP released emergency fixes on October 21 for two engine vulnerabilities that can allow unauthenticated attackers to execute code under vulnerable conditions. The research involved AI assistance, but people established exploit paths and led the fixes. Operators should update the PHP runtime serving their sites rather than assume an application or firewall update resolves the problem.

Key facts

• Two engine flaws are tracked as CVE-2026-109618 and CVE-2026-109619.
• Fixed upstream versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released October 21.
• PHP maintainers led remediation, with research and coordination from several organizations.
• The primary operational source is PHP’s release advisory.

A flaw below the application changes the response. A WordPress site can use well-maintained plugins and still depend on a vulnerable PHP engine. The same distinction applies to Drupal, Joomla and other applications: they help demonstrate the potential consequences, but the defects are in PHP itself. The PHP Foundation’s retrospective describes the investigation and the maintainer decisions behind the release.

The two problems concern memory and request state. One involves cleanup processing incompletely initialized data after memory runs out. Another involves a worker retaining pointers to memory freed with an earlier request, then consuming that stale state before resetting it. Think of a hotel clerk reusing yesterday’s room ledger after some pages have been removed: the reference still exists, but the information it points to is no longer valid. In software, that mismatch can produce crashes, disclosure or execution of attacker-controlled code.

The actual route matters. The first source advisory describes Apache’s embedded PHP configuration running shutdown after startup failure. A PHP-FPM worker exits on that particular failure path, preventing the same sequence there. That does not establish that PHP-FPM is safe overall: the Foundation separately reports confirmed execution through application-level paths. The second advisory concerns stale request-owned state with multiple possible producers and consumers.

AI attribution also needs this degree of precision. OpenAI’s account credits Calif with identifying one critical flaw using GPT-5.6 Sol and says Wiz independently discovered both vulnerabilities. Calif’s technical account describes a researcher and an unnamed language-model companion, including an agent noticing a dangerous ordering of operations. Wiz names several tools and models used throughout its investigation without assigning each individual vulnerability to one model.

OpenAI calls its broader maintainer-support initiative “Patch the Planet.” Its program description includes expert review, validation, patch development and coordinated disclosure. The PHP case illustrates that combination. It does not establish that a model autonomously discovered, proved and repaired an internet-wide vulnerability without human involvement. Discovery is one component of a security operation whose other components remain consequential.

Disclosure itself became difficult. The Foundation says circulating vulnerability identifiers and incorrect release information helped force the planned October 22 release forward. It also describes an accidentally published demonstration video and fixed container images appearing ahead of the coordinated release. Those events potentially gave attackers material to study while defenders were still preparing. Better discovery therefore creates a coordination problem as well as a technical opportunity.

Scale should be described carefully. W3Techs reported PHP on 69.3% of websites whose server-side language it knew on October 22. That describes prevalence within a measured denominator. It does not measure the percentage of all websites vulnerable to a working exploit. Likewise, Cloudflare’s mitigation account reports attack traffic and changing payloads, without establishing the circulated claims of millions of attempts or China-linked AI attackers.

A statement at release that PHP had not identified a functional exploit in the circulating demonstrations concerns the examples maintainers inspected. It does not cancel confirmed execution paths documented by the Foundation and researchers. Equally, a successful demonstration on one configuration cannot be generalized to every host. Both distinctions matter when deciding whether a dramatic headline exaggerates the attack surface or a skeptical headline understates the need to update.

The practical response is to follow the host or distribution’s security update, then confirm the web-facing runtime is patched; a command-line version check can examine a different installation. A web application firewall adds protection but does not replace the engine update. The strongest caveat to dramatic coverage is deployment-specific exploitability, not a reason to dismiss the fixes. The broader lesson connects to agent harnesses: model capability becomes useful through the surrounding process, and that process must carry a finding all the way to a verified repair.

Primary source, verified: read the paper →

Ground Truth. (2026, October 22). PHP fixes two critical engine flaws after AI-assisted security research. Ground Truth. https://groundtruth.day/news/php2shell-engine-fixes-ai-assisted-discovery.html

@misc{groundtruth:php2shell-engine-fixes-ai-assisted-discovery,
  title  = {PHP fixes two critical engine flaws after AI-assisted security research},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/php2shell-engine-fixes-ai-assisted-discovery.html}
}

Topics: cybersecurity · ai-security · vulnerabilities · php · coordinated-disclosure