PHP released security updates on Wednesday that fix two critical vulnerabilities capable of allowing unauthenticated remote code execution, flaws that researchers found with help from AI models. The PHP security team had scheduled the release for 14:00 UTC (10 a.m. ET) and rated each flaw 9.2 on the CVSS v4.0 scale.
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, the project said. PHP 8.1 and older no longer receive updates from the project, though its security team provided minimal source backports for versions 7.4, 8.0 and 8.1. PHP said all installations serving web requests are at risk, with the highest risk for those using Apache's mod_php.
Wiz Research, which detailed its findings in a blog post, said every PHP version released in the past decade is affected by at least one of the flaws, going back to version 5.4. Wiz said PHP powers 70% of websites, including those built on WordPress, Drupal and Joomla.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, stem from how PHP handles fatal errors, particularly out-of-memory errors, Wiz said. Wiz said it demonstrated remote code execution without authentication on the latest container images of WordPress, Drupal and Joomla. It also said attackers could read passwords, tokens and API keys from PHP process memory. The flaws sit in PHP itself, so even a simple "Hello World" application on an affected version can be vulnerable, Wiz said.
Wiz said it used Wiz Atlas, Google $GOOGL's Gemini 4 Argon and OpenAI's GPT-5.6 Sol in its research. The company said one researcher finished in a week what would have taken a world-class team months without frontier AI models.
Security firm Calif found the flaws separately, according to The Wall Street Journal. Calif researcher Ryan Austin used GPT-5.6 Sol during an August audit of PHP’s source code that OpenAI funded, The Wall Street Journal said. Volker Dusch, a security engineer at the nonprofit that oversees PHP, called it the worst security problem the project has confronted in more than 10 years and drew a comparison to Heartbleed, according to The Wall Street Journal.
Calif Chief Executive Thai Duong told The Wall Street Journal that someone could run AI against the patches and post an exploit script. "All hell will break loose," Duong said.
Word of the upcoming fix got out Tuesday when someone wrote about it on Hacker News, according to The Wall Street Journal. PHP then told users to prepare for a critical update the next day.
PHP said some settings reduce exposure for those who cannot update, such as setting session.upload_progress.enabled=0, but do not make an installation safe. Cloudflare rolled out firewall rules to every customer, even those using its free tier, according to BleepingComputer. Cloudflare CTO Dane Knecht said on X $TWTR that the company is seeing early attacks, according to BleepingComputer.