PHP & Java Critical Vulnerabilities: Memory Corruption, Compromised Certificates, AI-Assisted Discovery

PHP Vulnerabilities: Memory Initialization and Use-After-Free

Two PHP vulnerabilities were disclosed simultaneously: CVE-2026-109618 and CVE-2026-109619 , both rated CVSS v4.0 9.2. They affect PHP-FPM, Apache mod_php, and any deployment where PHP handles web requests, including WordPress, Drupal, and Joomla sites.

CVE-2026-109618: Incomplete Initialization Before Cleanup

During request processing, PHP allocates memory and populates internal structures in multiple steps. If memory exhaustion (OOM) occurs mid-process — triggered by the per-request memory_limit rather than system-wide RAM — initialization halts, leaving half-initialized data. The subsequent request cleanup routine then treats this partial data as valid, causing memory corruption. This flaw can be exploited before any application code runs, bypassing authentication checks. Verified exploits exist for mod_php; PHP-FPM is also in scope despite different startup failure handling.

CVE-2026-109619: Stale References Across Requests

A PHP worker process handles multiple requests sequentially. After a request ends, its memory is freed, but the worker persists. If error handling or cleanup fails to clear references to the freed memory, a use-after-free condition arises. Subsequent requests may dereference the dangling pointer before proper re-initialization, potentially leaking sensitive data (passwords, tokens, API keys) or achieving remote code execution depending on version, configuration, and application behavior.

Wiz Research demonstrated unauthenticated RCE on WordPress, Drupal, and Joomla, plus PHP process memory reads, primarily attributed to CVE-2026-109618. CVE-2026-109619 exploits were shown against Drupal and WordPress. These are verified research outcomes; not all live instances are confirmed compromised.

Fixed Versions and Mitigations

PHP 8.2 → 8.2.35

PHP 8.3 → 8.3.36

PHP 8.4 → 8.4.27

PHP 8.5 → 8.5.12

Older branches (8.1, 8.0, 7.4) receive minimal source patches from the security team; distributions and LTS vendors may backport. Upgrading the runtime actually serving traffic is mandatory — updating only WordPress plugins or local PHP does not fix the server. Container deployments must roll new images.

Temporary workarounds are limited: memory_limit=-1 (set in FPM pool or Apache php_admin_value) only blocks the OOM-triggered path of the first vulnerability and requires worker restart; OS-level allocation failure can still trigger it. Disabling session.upload_progress.enabled (and fatal_error_backtraces on PHP 8.5) mitigates the second flaw. Suppressing errors with @ or turning off display_errors does not help. None replace upgrading.

Java Vulnerability: Compromised eMudhra Intermediate CA Certificates

CVE-2026-91403 (CVSS v3.1 9.1) resides in security-libs/javax.net.ssl. OpenJDK and Oracle advisories identify eight compromised eMudhra intermediate CA certificates whose private keys were recoverable due to flawed key generation. An attacker with the private key can forge certificates trusted by any Java runtime that still includes these CAs in its trust store.

Affected versions per OpenJDK: 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512 and earlier. Oracle's JDK 8 uses 8u511 numbering; verify against the specific vendor's advisory.

Attack Scenario

When a Java application acts as an HTTPS client (e.g., calling external APIs), it validates the server's certificate chain. If the chain includes a compromised eMudhra intermediate CA, and the client still trusts it, a network-positioned attacker can present a forged certificate and impersonate the target service. This requires traffic redirection (e.g., DNS spoofing, BGP hijack) — not merely sending a request to the Java service.

Why Revocation Isn't Enough

CAs revoked the certificates, but clients may not check revocation status (CRL/OCSP). The runtime must be updated to remove trust in these CAs.

Remediation Steps

Prefer vendor-supplied runtime updates.

If immediate upgrade is impossible, OpenJDK provides updated blocked.certs (JDK 8 uses blacklisted.certs) and guidance to enable revocation checking. Preserve any custom entries when replacing the file.

Check every Java installation on the host; java -version reflects only one.

Debian/Ubuntu packages typically use system certificates — update the OS ca-certificates package. Homebrew and FreeBSD OpenJDK packages require direct updates.

AI's Role in Vulnerability Discovery and Exploitation

OpenAI disclosed that researcher Calif, under the Patch the Planet program, used GPT-5.6 Sol to discover a severe PHP vulnerability. Wiz independently found both PHP flaws using Wiz Atlas , Gemini 4 Argon , and GPT-5.6 Sol . PHP maintainers handled fixes and coordinated release.

Wiz reported that AI helped develop and adapt exploits for multiple applications across versions, configurations, and memory layouts within hours. The workflow mirrors agent-assisted programming: read code, hypothesize, run tools, inspect results, iterate. In security research, this accelerates verifying whether a crash leads to data leakage or code execution, and validating patches.

Key insight: Previously, high exploitation effort (time, expertise) left many bugs unexploited. AI reduces that trial-and-error cost. Old code hasn't changed, but the cost to research it has dropped. Previously abandoned analyses may now be feasible; exploits proven in one environment adapt more easily to others.

Defenders can also use these capabilities for code review, report verification, and patch testing. However, the PHP Foundation's retrospective reveals that even with earlier OOM hints (2024), fixing was stalled by compatibility concerns, DoS risks, extension refactoring, limited maintainer bandwidth, and decision delays. AI speeds verification, but maintainers must still choose fixes, distributions must package them, and operators must test and deploy. The coordinated disclosure date (originally Oct 22) was moved to Oct 21 after CVE numbers leaked, highlighting the gap between patch availability and public awareness.

The author recommends integrating AI into routine code review and patch validation, demanding reproducible evidence for high-risk reports, and confirming deployment after merges. Generating a vulnerability list alone leaves servers unpatched. Long-running projects should audit who updates legacy runtimes — container bases, tool-bundled JREs, old PHP versions — because AI accelerates discovery, but patching speed must keep pace.