Two critical PHP flaws: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35

The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP project says they "can allow unauthenticated remote code execution" and that "All PHP users are strongly encouraged to update immediately." OpenAI says it led a coalition, Patch the Planet, to coordinate the response before disclosure.

#What changed?

The PHP project published its security advisory and the four fixed releases on October 21, 2026. Its advance notice had scheduled the release for 14:00 UTC (19:30 IST) that day.

• CVE IDs: CVE-2026-109618 (GitHub advisory GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), which AWS and WIRED call PHP2Shell.
• Severity: the PHP Group, which issued the CVE records, rated both CVSS 4.0 9.2 Critical. The National Vulnerability Database has since scored both CVSS 3.1 9.8 Critical.
• Impact: the PHP advisory for CVE-2026-109618 says "The confirmed impact is unauthenticated remote code execution as the web worker account." The advisory for CVE-2026-109619 cites "memory disclosure and remote code execution with the web worker's privileges."
• Who is at risk: per the PHP project, "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." It adds: "We consider the risk highest for mod_php."

#What is OpenAI's role?

OpenAI says it spent two months leading "a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP." According to OpenAI's post, Calif found a critical flaw using OpenAI's GPT-5.6 Sol model as part of Patch the Planet, with Wiz "also independently discovering and reporting both vulnerabilities." OpenAI says "PHP’s maintainers led the fixes and release."

Wiz gives its own account. It says it found the first vulnerability on August 19, 2026, using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and reported the vulnerabilities to the PHP security team on August 24, 2026. WIRED notes that Wiz is owned by Google. The CVE records credit Calif, Wiz and OpenAI.

OpenAI also says:

• It has "committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services." This is subsidized access, not a cash fund. OpenAI gives no dates or eligibility criteria.
• It is sharing "a PHP version checker as a Codex skill" for operators. The repository says the checker compares versions and warns that "UNKNOWN does not mean the target is patched." It does not test for the flaws.
• It is "sharing a proposed approach" for handling critical vulnerabilities in widely used software, in five stages, and asking the security community to help improve it. OpenAI has not named the framework.

#What should you do?

Update to a fixed release. The PHP project says: "There are no complete mitigations, updating is the only safe choice."

• Distribution packages: "Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages," the PHP project says.
• Older versions: "PHP 8.1 and older no longer receive updates from the PHP project," it says, and its security team "provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1." Some vendors also provide backported fixes, so contact your vendor or upgrade to a supported version.
• rpms.remirepo.net: the PHP project urges users of that volunteer-maintained repository "to switch to distribution packages or build from source."
• PHP 8.2: the branch "reaches end of life on 31 December 2026," per the PHP project.

#Who is affected, and how widely?

The official records list only the supported 8.2 to 8.5 branches. Wiz says "Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4." The PHP project's advisory does not say how far back the flaws go.

On scale, Wiz describes PHP as a language "that powers 70% of all websites in the world," and OpenAI's post on X says PHP is used to run "an estimated 70% of websites." OpenAI calls the flaws "one of the most impactful security issues in recent memory."

#Why did government sites go offline?

Reuters reported that government websites in Europe and elsewhere went offline on October 21, 2026, after the disclosure. Reuters and the Dutch government described these takedowns as precautions.

• Netherlands: "The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities," Reuters reported. The BBC said the agency was taking its website offline "due to the vulnerabilities." The Dutch government said several sites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline "uit voorzorg", meaning as a precaution.
• Finland: Reuters reported that agencies in the Netherlands and Finland "took sites offline ahead of the fix as a precaution." The BBC said Finland "has temporarily shut down the government's public web services."
• Official advice: CISA says organizations that cannot update immediately "should take PHP-based systems offline until they can be patched or updated." The UK NCSC says that if mitigations cannot be applied in time, "you should consider taking the system offline until it can be fully mitigated."

#Are attackers using the flaws?

Cloudflare's chief technology officer posted on X at 07:43 UTC (13:13 IST) on October 21, before the fixes: "We are seeing early attacks emerging and are updating mitigations as new vectors show up." In a blog post, Cloudflare said it "observed attack traffic targeting our customers." It did not say how much traffic it saw.

AWS said its MadPot honeypots recorded an exploitation attempt dated October 17, 2026, "four days before public disclosure." Of attempts it saw on October 21, AWS said "it’s unclear if any of these attempts would have succeeded in real-world systems." In its post at 04:06 IST on October 22, 2026, AWS said the flaws are "now being broadly exploited in the wild." WIRED also reported AWS's findings.

CISA said it "has not observed exploitation of these vulnerabilities as of the time of publication." As of 08:01 IST on October 22, 2026 (02:31 UTC), CISA's entry in the CVE record still listed exploitation as "none", a rating set at 20:04 IST on October 21, before AWS published, and neither CVE was in CISA's Known Exploited Vulnerabilities catalog. OpenAI says that "To our knowledge, frontier AI found these vulnerabilities before attackers did."

For other recent security coverage, see the OpenCode console breach and Microsoft's agentic insider security controls. More is in our Privacy and Security hub.

#What is still unclear?

• How far back the flaws go. The PHP project has not said, and Wiz's figure is its own.
• Exploitation. AWS says the flaws are "now being broadly exploited in the wild," while CISA's rating was still "none" as of 08:01 IST on October 22, 2026.
• Daybreak for Frontline Defenders. OpenAI gives no opening date or eligibility criteria.