Patch first. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two unauthenticated remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. watchTowr has seen exploitation in the wild through its honeypots since October 21. Singapore’s CSA reports widespread attempts and multiple public proof-of-concept exploits. PHP says no configuration change fully mitigates either bug.
That’s the emergency. The part worth reading twice is the PHP Foundation’s own account of how this happened, because it complicates the tidy story that AI tools are now finding bugs humans can’t.
The bug was already on the table
CVE-2026-109618 is an out-of-memory flaw. If a request hits memory_limit at exactly the wrong moment, PHP can leave half-built internal data behind and later trust it. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full RCE was shown with default settings. The second bug, CVE-2026-109619, leaves global state pointing at memory from a previous request, so the next request on the same worker can use freed memory.
A PHP core developer found the first signs of the OOM problem in 2024, while fixing an issue from the Quarkslab audit. The security team worked out several fixes. Each had a cost: compatibility breaks, new denial-of-service risk, or changes to third-party extensions nobody thought could be coordinated. The team ran on consensus, no exploit path was known, and the few people who understand the engine had other fires. The fix stalled and restarted for months. The Foundation calls this a structural failure in its own words, which is more candour than most vendors manage.
What the AI-assisted audits actually did
An audit began on July 30, 2026, around the time PHP entered OpenAI’s Patch the Planet program. On August 11, Ryan A at Calif reported an unconditional RCE with the same root cause as the 2024 OOM issue. OpenAI independently reported the same root cause and added attack vectors on September 18. Wiz was auditing too. From August 11, the fix became the top priority for everyone on the Foundation’s security staff.
My read: the AI-era tooling earned its keep here, but the value was in proving exploitability, not in spotting the bug. A theorised exploit sat unresolved for over a year. A demonstrated one got people working weekends. The Foundation now runs Anthropic’s Claude Mythos for scanning and OpenAI’s Daybreak Red for validating reports and exploits, and that validation role looks like the important one. Turning “this might be bad” into “here is a shell” is what breaks a deadlock in a consensus-driven team.
There’s a cost. The team has published 15 CVEs since July 1 and waded through more than 100 reports that were invalid, duplicates or not reproducible. The Foundation says AI helps group and validate them, but a person makes every call and writes every patch. More scanners pointed at open source means more triage for a small group of humans, and the funding to pay them is what made this fix possible at all.
Disclosure didn’t hold
The CVE details leaked on social media on October 20, two days before the planned October 22 disclosure, forcing an emergency release on October 21 at 14:00 UTC. Exploitation showed up the same day. Linux distributions had patches early, so check your distro’s packages.
If you’re on PHP 7.4, 8.0 or 8.1, there’s no official release, only distro or LTS vendor packages and PHP’s minimal source backports. PHP 7.3 and older, including PHP 5, which watchTowr confirmed is affected, get nothing. CSA also warns that PHP may be running on servers whose main site doesn’t use it, tucked inside some third-party component. As of October 22, neither CVE was on CISA’s Known Exploited Vulnerabilities list.