PHP patches two critical RCE flaws exploited before they were disclosed

The PHP project released emergency security patches on October 21, 2026, fixing two critical unauthenticated remote code execution vulnerabilities — but attackers had already been exploiting them since October 17, four days before the fixes arrived. The U.S. National Security Agency advised organizations running PHP to update immediately or take affected systems offline.

Both flaws carry a CVSS v4.0 score of 9.2. Government websites, schools, and hospitals worldwide went offline during emergency patching, according to Reuters. Security professionals described the scope as comparable to — and in some respects larger than — the 2014 Heartbleed crisis.

What the vulnerabilities are

CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is an out-of-memory corruption bug. If a PHP request hits the memory limit at exactly the wrong moment, the runtime can leave partially initialized data that it later treats as valid. On Apache with mod_php, an unauthenticated attacker can trigger this before application code even runs. Full remote code execution was demonstrated against default configurations.

CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) exploits stale global state. A fatal error at the wrong point can leave internal PHP state pointing to memory from a previous request. A later request on the same worker process can then exploit that dangling pointer, enabling use-after-free and confirmed RCE on Apache with mod_php.

Both flaws affect PHP 8.2, 8.3, 8.4, and 8.5. Fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older receive no upstream patches and depend on third-party vendors for protection.

AI tools found the bugs; an embargo leak accelerated the crisis

Multiple research teams found the root cause independently, beginning in August 2026. Participants in OpenAI’s “Patch the Planet” program submitted the first complete RCE report on August 11. Alpha-Omega had earlier scanned PHP with Anthropic’s Claude Mythos. Trail of Bits and Wiz also identified the same underlying issue.

The coordinated disclosure nearly collapsed. On October 20, CVE IDs and an incorrect CVSS score of 10.0 leaked online with a wrong release time. Hours later, researcher Calif accidentally published a video demonstrating a working proof-of-concept exploit, which spread rapidly on social media. Early the next morning, Chainguard broke the embargo by publishing fixed Docker images more than six hours before the scheduled public release.

AWS analysts told Wired that exploitation began on October 17, meaning attackers had access to working exploits at least four days before patches were available to defenders.

The fix took months — and that was the real failure

The PHP Foundation acknowledged in a post-mortem that the root cause was first identified in 2024 during an external audit. Despite knowing about the issue, the fix stalled for months over disagreements about implementation trade-offs involving compatibility, denial-of-service risk, and impact on third-party extensions. The Foundation called this “a structural failure.”

In response, the Foundation created an Ecosystem Security Team in May 2026, hired additional security engineers, and changed its decision-making process so that the security team can act by majority vote. It is also building out sanitizer-based testing and reproduction environments across all supported platforms.

Cloudflare deployed WAF mitigations approximately nine hours before the public disclosure and made them available to all service tiers. CISA also added the vulnerabilities to its Known Exploited Vulnerabilities catalog and issued an advisory alongside the NSA and FBI.

As reported by the PHP Foundation, the incident also illustrates how AI-assisted security research is compressing the gap between vulnerability discovery and exploitation. Multiple AI tools independently found the same critical flaw within weeks of each other — raising the stakes for coordinated disclosure to work faster.