The PHP Security Crisis Explained: Why AI Uncovered It and How to Patch Your Site

A critical security crisis has emerged within PHP, the programming language that powers much of the internet ². The discovery of two severe vulnerabilities has led to widespread disruption, with government agencies and IT departments taking high-profile websites offline to prevent exploitation ³. These flaws, which have existed in the code for over a decade, were recently identified by artificial intelligence tools designed to audit legacy codebases ².

To protect your infrastructure, applying a PHP vulnerability patch is now a critical priority for system administrators and site owners. The vulnerabilities allow unauthenticated attackers to execute code remotely on affected servers, potentially granting them full control over the web environment ⁴, ⁵.

The nature of the PHP security crisis

The current crisis centers on two related critical remote code execution (RCE) vulnerabilities, collectively referred to by some security agencies as “php2shell” ⁴, ⁵. These flaws reside in the core components of PHP that handle memory management and error handling—parts of the language that nearly every web request touches ⁴.

• CVE-2026-109618: This vulnerability involves memory corruption during out-of-memory (OOM) handling. If a request hits the PHP memory_limit at a specific moment, the system may leave behind partially initialized data. PHP might later treat this invalid data as valid, leading to memory corruption ⁴, ⁶.
• CVE-2026-109619: This flaw involves “stale global state.” A fatal error occurring at a precise point can leave internal states pointing to memory used by a previous request. A subsequent request handled by the same worker process can then access that freed memory, leading to a use-after-free error ⁴.

Both issues are particularly dangerous because they can be triggered by unauthenticated requests before any specific application code even runs ⁴. This means an attacker does not need a login or special permissions to target a server.

Why AI uncovered decade-old bugs

While these vulnerabilities have existed in the PHP codebase for ten years, they remained undetected by human auditors and traditional scanning tools ². The breakthrough came from generative AI models capable of analyzing massive amounts of legacy code to find subtle logical errors ².

AI code auditing tools are increasingly used to identify complex patterns that lead to memory corruption, such as the specific timing issues found in PHP’s OOM handling ². This shift in discovery methods suggests that more “dormant” vulnerabilities in foundational internet technologies may be uncovered as AI tools become more sophisticated ².

Essential steps for a PHP vulnerability patch

Security organizations, including CISA and CERT-EU, have urged immediate action to secure web servers ⁵, ⁶. Because PHP is often embedded within other software packages, it may not be immediately obvious that a system is at risk ⁵.

Identify and inventory systems

Administrators should first inventory all systems running PHP. This includes standard web servers and internal tools. The vulnerabilities affect all major PHP installations, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed ⁵.

Apply official updates

The PHP project has released several versions to address these flaws. You must update your environment to one of the following versions or newer ⁴, ⁵:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Mitigation for unsupported versions

If you are running PHP 8.1 or older, these versions are unsupported and will not receive an official patch ⁵. CISA recommends taking these systems offline until they can be migrated to a supported version. If immediate patching is impossible, a web application firewall (WAF) may provide temporary, limited protection, but it is not a substitute for a full update ⁵.

Monitoring for exploitation

As of late October 2026, these vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, meaning active attacks have been observed in the wild ⁵. Proof-of-concept (PoC) code is also circulating publicly, increasing the risk of automated attacks ⁶.

IT managers should monitor for suspicious activity, such as PHP worker processes attempting to launch shells or download external tools ⁵. CERT-EU also suggests isolating internet-facing applications from public networks if a fix cannot be verified immediately ⁶.

Frequently asked questions

Which versions of PHP are affected?

All versions of PHP serving web requests are considered at risk. Official patches are available for the 8.2, 8.3, 8.4, and 8.5 branches ⁴, ⁵.

How did AI find these flaws?

AI models were used to audit the PHP codebase, identifying subtle memory management errors that had gone unnoticed by human developers for over a decade ².

Is there a third vulnerability?

On October 23, 2026, a third RCE vulnerability was disclosed. However, it only affects web applications with highly unusual configurations and is considered an unlikely risk by the PHP team ⁶. No out-of-band release was issued for this third flaw, though general mitigations are advised ⁶.

What if I cannot update immediately?

If patching is not feasible, you should consider taking the affected systems offline or isolating them from the public internet to prevent remote exploitation ⁵, ⁶.

Conclusion

The PHP security crisis highlights the ongoing risks associated with the aging infrastructure of the modern web. With AI tools now capable of finding long-hidden flaws in legacy code, the speed at which vulnerabilities are discovered is likely to increase. For site owners and administrators, the immediate takeaway is clear: identify your PHP versions and apply the necessary patches to prevent unauthenticated remote code execution on your servers ⁵.