AI-found critical PHP flaws patched as Japan's Prime Minister urges sites to update

On October 21, 2026, the PHP team released versions that fix two critical vulnerabilities in the language engine. According to PHP's security advisory, CVE-2026-109618 and CVE-2026-109619 allow remote code execution on the server without authentication. Both are rated 9.2, critical, on the CVSS v4.0 scale. Wiz Research, which found the flaws, described in a post it calls PHP2Shell how the work was done with its AI-driven research tool.

The flaws were found with AI

According to Wiz, the flaws were found with Wiz Atlas, the company's AI-based vulnerability research tool. Wiz writes that Google's Gemini 4 Argon made a major contribution, from finding the bug to exploit development, attack detection and patch validation, and that OpenAI's GPT-5.6 Sol was used throughout the research. The company says the models helped adapt the exploit to different PHP versions, configurations and memory layouts and helped analyse failed attempts. Wiz says the bugs had been sitting in the PHP code for more than a decade.

In the timeline Wiz shared, the first flaw was found on August 19; unauthenticated code execution was confirmed against Drupal the next day and against WordPress on August 21. The flaws were reported to the PHP security team on August 24, PHP began the fix process on September 21, and the patches were released on October 21. The PHP team, Calif and OpenAI took part in the work. For those who cannot patch right away, companies including Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel prepared mitigations on their own platforms.

What the flaws do

According to PHP's advisory, CVE-2026-109618 arises when PHP aborts work because it runs out of memory: request data is left half-initialized, and the cleanup stage may treat that invalid data as valid. In CVE-2026-109619, internal state owned by a request can survive after its memory has been freed, and a later request handled by the same worker may use that stale state. Wiz adds that the same bugs allow the server's memory to be read remotely, and that this memory may hold passwords, session tokens, API keys and certificates belonging to other requests.

The advisory says every PHP installation that serves web requests is affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php; the PHP team says an exploit has been demonstrated in which a single unauthenticated request triggers the attack before any application code runs. Wiz also writes that the attack does not require WordPress, Drupal or Joomla, and that even a simple "Hello World" app on an affected version may be vulnerable.

Fixed versions

• 8.5.12 for PHP 8.5
• 8.4.27 for PHP 8.4
• 8.3.36 for PHP 8.3
• 8.2.35 for PHP 8.2

PHP 8.1 and older no longer receive updates from the PHP project; the team has published minimal fix branches on GitHub for 7.4, 8.0 and 8.1. Linux distributions and long-term support vendors received the patches in advance, so the distribution's own package update also brings the fix. PHP 8.6.0 RC4, still in testing, includes both fixes.

Temporary mitigations if you cannot update yet

The PHP team stresses that updating is the only complete fix, but it also lists temporary measures. For CVE-2026-109618, it recommends setting memory_limit to -1 in a way applications cannot override (php_admin_value in FPM or Apache), lowering post_max_size to 8M (32M if uploads are needed), keeping upload_max_filesize below that, and limiting request sizes at the web server or proxy. For CVE-2026-109619, it recommends setting session.upload_progress.enabled=0 and restarting every worker, and on PHP 8.5 also setting fatal_error_backtraces=0.

Until the patch is applied, Wiz advises watching for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unusually large or malformed PHPSESSID cookies, and unexplained PHP worker restarts.

Governments weigh in

In a post on X on the evening of October 21, Japan's Prime Minister Sanae Takaichi urged site owners to be ready to apply the patch as soon as it was released, and said that temporarily suspending site functions is an effective way to reduce risk when patching quickly is difficult (Jiji Press). Drupal's security team had also warned its users a day before the release.

How to update

Check the version on your server with php -v, update through your distribution's package manager or with the new PHP release, then restart PHP-FPM and the web server. If you use shared hosting, ask your provider whether the update has been applied. If you use Docker, rebuild your images on the new PHP base; containers running old images stay vulnerable.

The technical details and the scope of the flaws currently rest on statements from the PHP team and Wiz. Wiz's post does not include exploit code. PHP's official advisory lists fixed versions for the supported branches, while Wiz writes that the flaws affect versions going back to PHP 5.4, so sites still running unsupported versions face more risk. That the flaws were found with AI is a reminder that similar tools may also be in attackers' hands, which makes delaying the patch riskier. For a fuller picture, follow reviews from independent security researchers too.