PHP Emergency Patch: Two Critical Flaws AI Models Found Before Attackers Could

On October 21, the PHP project did something it rarely does. It pushed out emergency security releases for two memory-safety bugs, tracked as CVE-2026-109618 and CVE-2026-109619, that could let an attacker run their own code on a server simply by sending it a crafted request. The bugs are rated up to CVSS 9.2, and Wiz Research says every PHP release going back to version 5.4 is affected. Here is the strangest part of the story. The flaws were found by AI models doing security research, and the full details leaked before the fixes were ready, turning a planned disclosure into a race.

Two bugs with a score that demands attention

CVE-2026-109618 and CVE-2026-109619 are both memory-safety flaws in the PHP core. In plain language, that means PHP mishandles memory in certain situations, and a careful attacker can turn that mishandling into remote code execution, which is the worst category of web vulnerability. It hands an intruder the ability to run commands on the server, steal databases, or plant backdoors that linger for months.

A CVSS score of 9.2 out of 10 puts these bugs in the “critical” bracket, the kind of rating that makes security teams cancel their evenings. Wiz, the cloud security company that reported the flaws, says affected versions stretch back to PHP 5.4, a release from 2012. That reach matters because PHP powers a huge share of the world’s websites, and plenty of those sites still run old, unmaintained versions.

AI models did the finding

Wiz says it uncovered the flaws using its Wiz Atlas agent working alongside two frontier models: Gemini 4 Argon and GPT-5.6 Sol. In a separate statement, OpenAI said that Calif, a partner in its Patch the Planet programme, found one of the flaws using GPT-5.6 Sol.

That makes this one of the clearest examples yet of AI systems discovering serious vulnerabilities faster than traditional human review. Security researchers have talked about this moment arriving for years. This week it actually happened, and on one of the most widely deployed pieces of software on the planet. The tools are plainly getting good at this work. The uncomfortable question is what happens when the same capability lands in the wrong hands.

A leak turned disclosure into a scramble

Coordinated disclosure is supposed to work in a careful order. A researcher tells the vendor privately, the vendor builds a fix, and only then does the world learn about the bug. This time the details slipped out early, according to SecurityWeek, and the PHP project had to ship its patches ahead of schedule on October 21.

Security firms reported seeing exploitation attempts, some of them before the fixed versions were even available. That is the nightmare scenario for every patch cycle: attackers hunting for vulnerable servers while defenders are still downloading the fix. The US National Security Agency weighed in with unusually blunt advice, telling organizations to take servers that cannot be patched offline entirely.

What to do if you run a website

If your site runs on PHP, and that includes most WordPress, Drupal, and Joomla sites, update now. Apply the emergency release for your PHP branch and check that your host has actually moved you to the fixed version, rather than just scheduling it for later.

If you manage servers yourself, patch every machine running an affected version. Go back through your full inventory instead of assuming your newest boxes are fine. And pay attention to the version floor. If you are still on PHP 7.x or older, these bugs are a strong reason to finally plan that upgrade, since old branches eventually stop receiving fixes at all.

After patching, look at your logs for unusual activity around October 21, when proof-of-concept exploits were circulating. If anything looks wrong, assume compromise and investigate rather than hoping for the best. Small business owners on shared hosting mostly need one step: ask the host to confirm the patch is applied.

The pattern behind the panic

This incident says something larger about where software security is heading. AI-assisted bug hunting is moving from lab demonstrations to real discoveries in real software, and defenders are not the only ones who can use it. Wiz pushing its own findings through AI agents is the positive version of the same story that keeps chief security officers up at night.

Expect more of these races. When discovery gets faster but deployment stays slow, the window between a bug being found and it being fixed everywhere becomes the most dangerous part of the internet. The PHP patch scramble of October 2026 is probably a preview, not an exception.

Frequently Asked Questions

Which PHP versions are affected by these flaws?

According to Wiz Research, the flaws affect PHP releases going back to version 5.4, which dates to 2012. The emergency fixes shipped on October 21 cover the currently supported branches, so check your version and update to the latest release in your branch.

Why are CVE-2026-109618 and CVE-2026-109619 rated so dangerous?

Both are memory-safety bugs that can allow remote code execution, which means an attacker could run commands on your server without logging in. Their CVSS score of up to 9.2 places them firmly in the critical range.

I do not manage my own server. What should I do?

Contact your hosting provider and ask them to confirm your site is running a patched PHP version. Most managed and shared hosts apply security patches quickly, but it is worth asking for direct confirmation rather than assuming the work is done.