China’s tracked PHP hosts adopted fixes more slowly than U.S. hosts after two critical flaws were disclosed, cybersecurity firm Bitsight found, highlighting uneven protection across systems that serve websites.
Bitsight’s first-week scan, covering the period through Oct. 27, revisited 9.47 million hosts the firm had previously observed running vulnerable PHP versions. It reported fixed builds on 33.5% of the overall group. In Bitsight’s country breakdown, the share was 3.8% in China and 26.2% in the United States.
The PHP project released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on Oct. 21 to address CVE-2026-109618 and CVE-2026-109619. Under certain conditions, the vulnerabilities could allow an unauthenticated attacker to execute code on affected PHP installations serving web requests. The PHP project urged users to update.
Patch rates also differed by PHP branch. Bitsight found 68.6% of hosts on supported versions 8.2 through 8.5 had updated within a week, compared with 6.4% on end-of-life versions 8.1 and older. Some distributions and long-term support providers offer backported fixes for older versions, the PHP project says. Bitsight reported faster updates where hosting providers managed PHP for customers; its figures do not establish why the China sample had a lower rate.
OpenAI said Calif used its GPT-5.6 Sol model through the Patch the Planet initiative to identify one critical flaw. The company said Wiz separately found and reported both vulnerabilities. The PHP Foundation traced the first recognition of an underlying out-of-memory issue to 2024 and said difficult technical trade-offs and limited specialist capacity delayed a fix.
Amazon Threat Intelligence said its MadPot honeypot recorded an attempted exploit on Oct. 17, four days before public disclosure. The attempt came from an IP address associated with a commercial anonymization network. Website and server operators, or providers managing their PHP installations, face the work of applying fixed releases or obtaining vendor backports where available.