PHP issued fixes Wednesday, Oct. 21, for two flaws that can let unauthenticated attackers run code on servers, as researchers used AI tools and Amazon logged pre-disclosure attempts.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each received a 9.2 rating under CVSS v4.0. PHP released patched builds 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP warns that web-facing installations may be exposed, with Apache’s mod_php configuration carrying the highest risk. Its security team said, “There are no complete mitigations, updating is the only safe choice.”
PHP said versions 8.1 and older no longer receive project updates, though some distributions and long-term support vendors provide backports. Some vendors also provide fixes. The National Security Agency (NSA) urged operators to inventory affected systems and apply patches. The NSA advised operators to consider taking affected systems offline if they cannot be mitigated promptly.
Amazon said its MadPot honeypot logged an attempted exploit on Saturday, Oct. 17. It also identified multiple proof-of-concept exploits, the earliest at about 10 p.m. ET Tuesday, Oct. 20 (02:00 UTC Wednesday). Amazon recorded additional attempts targeting MadPot through 4 a.m. ET Wednesday, Oct. 21 (08:00 UTC). The company said it could not determine whether the activity would work against real-world systems.
OpenAI said Calif used GPT-5.6 Sol in its research, while Wiz said its researchers independently found and reported both vulnerabilities using AI tools. Amazon’s report did not attribute its observed attempts to AI.
The PHP Foundation said a core developer found early signs of the out-of-memory flaw while following up on an issue raised in a 2024 audit. Researchers had not established a concrete way to exploit it at that point. The foundation said technical trade-offs, a small group of experienced developers and the security team’s decision process delayed a fix, calling the delay a “structural failure.”
The foundation said CVE identifiers began circulating Tuesday, Oct. 20, prompting PHP to move its planned release forward from Oct. 22 to Wednesday, Oct. 21. On Friday, Oct. 23, PHP issued a separate advisory for an unlikely remote-code-execution risk involving an unusual combination of configuration and application code. It recommended disabling session.upload_progress.enabled until the next regular bug-fix release, when it plans to publish a full advisory for CVE-2026-115560.
