Critical PHP Vulnerabilities (CVE-2026-109618/19) Trigger Global Outages; AI-Assisted Discovery, Emergency Patches Released

PHP's Ubiquity and the Scope of Impact

PHP, an open-source scripting language with over 30 years of history, powers an estimated 70% of all websites, including major platforms such as WordPress, Drupal, Joomla, Magento, Wikipedia, and Facebook. Content management systems and publishing templates are predominantly built on PHP. Drupal, widely used by government agencies worldwide, is among the affected services; for example, Australia's GovCMS platform runs 391 government sites on Drupal.

Vulnerability Details: CVE-2026-109618 and CVE-2026-109619

The PHP Foundation states the flaws reside in "parts of PHP involved in almost every request: memory management and error handling." Security vendor Hadrian dubs the combined exploit chain "PHP2Shell." According to the U.S. National Security Agency, the vulnerabilities corrupt server memory via crafted requests, enabling attacks that may "provide a direct path to the server's file system or database." Both CVEs allow unauthenticated remote code execution.

Affected Deployments and Patch Releases

All PHP installations handling web requests are vulnerable, including PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP, and LiteSpeed. The PHP project issued emergency updates: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Developers urge immediate upgrading.

Severity and Exploitation Status

CERT-EU assigned a CVSS score of 9.2 and advised isolating internet-facing applications if immediate patching is impossible. Hadrian reports the vulnerabilities are "being exploited at scale." Amazon Threat Intelligence detected exploitation attempts against honeypots four days before public disclosure, and multiple proof-of-concept exploits appeared the day before the embargo lifted.

Discovery Timeline and AI's Role

The PHP Foundation collaborated with Anthropic's frontier models and enrolled PHP in OpenAI's "Patch the Planet" program. These AI systems, alongside independent researcher Ryan A (mid-August), identified the flaws. Disclosure was originally embargoed until October 22, but leaks on forums and social media forced early release.

Patching Challenges and Expert Perspectives

The core location of the bugs makes fixes difficult: changes risk breaking compatibility, degrading performance, or forcing updates across the vast third-party extension ecosystem. Huntress senior researcher John Hammond notes the difficulty of locating every vulnerable PHP instance. Sophos threat intelligence VP Don Smith emphasizes monitoring for anomalous processes and command execution. ANU professor Simon warns that sites still online without patching are prime targets.

AI-Driven Vulnerability Discovery: A Double-Edged Sword

AI accelerates vulnerability detection, finding issues humans might miss or take months to uncover. This fuels an arms race: defenders and attackers both leverage AI. The PHP Foundation operates on donations with only 13 full-time and part-time engineers, while AI development attracts billions in investment, highlighting a resource asymmetry in securing foundational infrastructure.