The PHP project released fixes Oct. 21 for two critical vulnerabilities that can let unauthenticated attackers run code on web servers, as the Wikimedia Foundation took supporting services offline pending safe patching. The Foundation warned that its wikis could also experience outages.
The flaws, CVE-2026-109618 and CVE-2026-109619, each carry a critical score of 9.2 out of 10. The corrected releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP said exposure extends to every installation that serves web requests. The project no longer updates PHP 8.1 and older, though some vendors provide backported fixes.
OpenAI said security firm Calif identified one flaw with GPT-5.6 Sol through its Patch the Planet initiative. Wiz said it independently found both flaws using Wiz Atlas and the models Gemini 4 Argon and GPT-5.6 Sol. Wiz estimates PHP is used by 70% of websites worldwide.
The PHP Foundation said a developer found early signs of the underlying issue in 2024, when no concrete attack path was known. Calif reported an unconditional route to remote code execution on Aug. 11, 2026. The Foundation said a small group weighed technical trade-offs through a consensus process while security staffing remained limited. It later called the delay a “structural failure.”
Amazon Threat Intelligence said its MadPot honeypot recorded an exploitation attempt on Oct. 17, four days before public disclosure. Amazon said it did not know how the actor obtained information about the flaw before its release. Amazon later said proof-of-concept code appeared within hours of disclosure and was used against its sensors.
The U.S. National Security Agency (NSA) advised organizations to install the fixes and take systems offline if an immediate update is not feasible. The Wikimedia Foundation said some volunteer-supported services may remain offline until their owners apply updates.
