PHP & Java Critical Vulnerabilities: Memory Corruption, Cert Trust Flaws & AI Discovery

PHP Vulnerabilities: Two Memory Corruption Flaws Leading to RCE

PHP released emergency updates for two vulnerabilities, dubbed PHP2Shell , both rated CVSS v4.0 9.2. They affect PHP-FPM, Apache mod_php, and any deployment where PHP handles web requests, including WordPress, Drupal, and Joomla sites.

CVE-2026-109618: Partial Initialization Before Cleanup

During request processing, PHP allocates memory and populates internal structures in multiple steps. If memory exhaustion (OOM) occurs mid‑initialization — triggered by the per‑request memory_limit rather than system‑wide OOM — the request is aborted leaving half‑initialized data. The subsequent cleanup routine treats this incomplete data as valid, causing memory corruption. Verified exploits for mod_php execute before any user‑level code (e.g., login checks) runs. PHP‑FPM is also in scope despite different startup failure handling.

CVE-2026-109619: Use‑After‑Free Across Requests

A PHP worker process handles multiple requests sequentially. After a request ends, its memory is freed but the process persists. If error handling or cleanup leaves a dangling reference to the freed memory, the next request may reuse that reference before proper re‑initialization — a classic use‑after‑free . Attackers who can influence inputs and memory layout may escalate this to information disclosure or remote code execution. Exploitability depends on version, configuration, and application behavior.

Wiz Research demonstrated unauthenticated RCE on WordPress, Drupal, and Joomla, plus direct PHP process memory reads (passwords, tokens, API keys) primarily under CVE-2026-109618, and separate RCE demos for Drupal and WordPress under CVE-2026-109619. These are verified research outcomes, not evidence that all live instances are compromised.

Affected Versions and Mitigation

PHP 8.2 → fixed in 8.2.35

PHP 8.3 → fixed in 8.3.36

PHP 8.4 → fixed in 8.4.27

PHP 8.5 → fixed in 8.5.12

Older branches (8.1, 8.0, 7.4) receive minimal source patches from the security team; distributors may backport. Upgrading the runtime actually serving the site is mandatory — updating only WordPress plugins or a local PHP install does not fix the production environment. Container deployments must roll out new images.

Temporary workarounds are limited: memory_limit=-1 (set via FPM pool or Apache php_admin_value and restart workers) only blocks the OOM‑triggered path of the first flaw; disabling session.upload_progress.enabled (and fatal_error_backtraces on PHP 8.5) mitigates the second. Suppressing errors with @ or turning off display_errors does not help. None replace upgrading.

Java Vulnerability: Trust in Compromised eMudhra Intermediate CA Certificates

OpenJDK and Oracle disclosed CVE-2026-91403 (CVSS v3.1 9.1) in security-libs/javax.net.ssl. The issue: eight eMudhra intermediate CA certificates had flawed private‑key generation, allowing private‑key recovery from the public certificate. An attacker with the private key can forge certificates that chain to a trusted root, enabling impersonation of HTTPS services.

Affected versions per OpenJDK: 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512 and earlier. Oracle's JDK 8 uses a different numbering (8u511); verify against the vendor advisory you actually run.

Java clients validate server certificates by chaining to trusted CAs. If the compromised intermediates remain trusted, a man‑in‑the‑middle attacker who can redirect traffic can present a forged certificate that passes validation. This applies to any Java service acting as an HTTPS client (backend‑to‑backend calls, microservices, etc.), not only user‑facing servers.

Revocation alone is insufficient because clients may not check revocation lists (CRL/OCSP). The fix removes trust in the affected intermediates. Remediation depends on installation method:

Standalone runtimes: apply vendor updates.

Cannot upgrade immediately: update the certificate blocklist ( blocked.certs on JDK 9+, blacklisted.certs on JDK 8) preserving custom entries, or enable revocation checking.

Multiple Java installations: update each runtime, not just the one shown by java -version.

Distro packages (Debian, Ubuntu, etc.) often use system certificates; update the OS certificate store. Homebrew and FreeBSD OpenJDK packages require direct updates.

AI's Role in Vulnerability Discovery and Exploit Development

OpenAI disclosed that the Patch the Planet program used GPT‑5.6 Sol to discover a critical PHP vulnerability; Wiz independently found and reported both PHP flaws. Wiz's report notes using Wiz Atlas , Gemini 4 Argon , and GPT‑5.6 Sol to chain multiple errors, adapt exploits across versions, configurations, and memory layouts, and iterate through debugging cycles — reducing exploit development from weeks to hours.

The author compares this to typical coding agent workflows: read code, hypothesize, run tools, inspect results, repeat. In security research, the same loop verifies whether a crash leaks data or achieves code execution, and validates patches. AI lowers the trial‑and‑error cost that previously made many vulnerabilities impractical to exploit.

Old code hasn't changed, but the cost of researching it has dropped. Previously abandoned investigations may now be feasible; exploits proven in one environment adapt more easily to others. Defenders can also use these capabilities for code review, report verification, and patch testing, but the full remediation pipeline — maintainer decisions, distro packaging, user testing and deployment — remains human‑bound.

The PHP Foundation retrospective acknowledged OOM‑related leads from 2024 that stalled due to compatibility concerns, DoS risks, extension refactoring, limited manpower, and indecision. The coordinated disclosure was originally set for 2026‑10‑22 but moved to 21st after CVE numbers leaked early, highlighting the gap between patch availability and public awareness.

Practical takeaway: integrate AI into routine code review and patch verification; demand reproducible evidence for high‑risk reports; confirm deployment after merges. Long‑running projects should audit who updates legacy runtimes, container images, and bundled JREs — AI finds bugs faster, but patching speed must keep pace.

References

[1] PHP Official Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

[2] OpenJDK Advisory: https://openjdk.org/groups/vulnerability/advisories/2026-10-21

[3] eMudhra Incident Disclosure: https://emudhra.we-have-a-problem.com/

[4] OpenAI Coordinated Disclosure: https://openai.com/zh-Hans-CN/index/coordinated-disclosure-of-critical-vulnerabilities/

[5] Wiz Research Report: https://www.wiz.io/blog/php2shell-php-rce

[6] PHP Foundation Retrospective: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/