Emergency PHP patches address severe bugs found with AI help
The PHP project issued emergency fixes for two critical memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. The bugs could let unauthenticated attackers run code on web servers or expose secrets in process memory; patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP workers must be restarted. Researchers used frontier AI models to turn the long-hidden flaws into working exploits.
The defects are in PHP’s engine, not in an app or add-on, so a CMS update alone would not eliminate them. They stem from how PHP terminates requests during fatal errors, particularly memory exhaustion, potentially leaving a recycled worker with damaged or released memory state.
Wiz researchers used advanced AI systems, including Gemini 4 Argon and GPT-5.6 Sol, to turn the long-concealed issues into working exploits. Exploitation attempts appeared on disclosure day, and Censys reported that roughly 58% of scanned PHP hosts remained unpatched after the fixes were released.
Since PHP supports a large share of websites, these bugs could affect site operators, hosting providers, and visitors whose information may be exposed. Unauthenticated code execution may allow server-account takeover, while memory disclosure could reveal credentials or keys. Organizations that patch late or skip worker restarts may stay vulnerable, so real-world harm may hinge on how quickly administrators and hosting teams respond.