A disclosure accompanied by patches
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to address CVE-2026-109618 and CVE-2026-109619. The flaws involved corrupted or stale internal state after fatal errors. PHP identified Apache with mod_php as the highest-risk configuration, including a demonstrated attack before application code runs. Other paths depended on the server interface and application behavior. [2]
What AI contributed
OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through Patch the Planet, while Wiz independently discovered and reported both vulnerabilities. Calif described using an agent to inspect PHP internals, develop exploit chains and test variants. PHP maintainers led the fixes and release, supported by researchers and infrastructure providers. [3][1]
The result was a set of demonstrated exploits and released fixes, not evidence that every PHP website could be compromised in the same way. Calif's tests covered particular applications and configurations; PHP's advisory distinguishes attack paths and mitigations. A language's share of websites does not establish the number of exploitable deployments. [1][2]
Sources
- A tale of two PHP remote vulnerabilities
Calif · Oct 21, 2026
- Security advisory: Critical remote code execution vulnerabilities, update now
PHP · Oct 21, 2026
- Patch the Planet: global response coordination as agents uncover critical vulnerabilities
OpenAI · Oct 21, 2026
- No, the internet isn't dying due to 'one of the most significant vulnerabilities of 2026' - but this is what you need to know
TechRadar · Oct 22, 2026