Two critical PHP flaws found with AI tooling prompt patched releases
Operators running PHP 8.1 or older have no official fix and must move to a supported branch.
OpenAI says researchers in its Patch the Planet program used GPT-5.6 Sol to find two critical memory-handling flaws in PHP, a language the company estimates runs about 70% of websites. Calif, a cybersecurity firm, began auditing PHP on July 30, 2026, at the PHP Foundation's request, and its researcher located an exploitable bug on Aug. 11, with Wiz independently finding a second. The flaws, CVE-2026-109618 and CVE-2026-109619, could allow remote code execution without credentials and expose passwords, tokens and API keys, each scored 9.2 out of 10. Patched releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 arrived on Oct. 21, moved up from Oct. 22 after premature disclosures; PHP 8.1 and older will get no official fix, so operators on those branches must upgrade.
Why it matters
PHP runs on a large share of the web, so the flaws reach a wide range of sites and their operators. Because the bugs could allow remote code execution without credentials and expose passwords, tokens and API keys, sites that have not patched are exposed to attackers, and the earlier-than-planned release left less time to prepare. Sites on PHP 8.1 or older now have no official fix, so the only route to a patched version is to upgrade.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- Tom's Hardware