PHP shipped emergency security updates on Wednesday. They fix two critical flaws that let an unauthenticated attacker run code on almost any server running the language. The release capped a frantic two days that pulled websites offline across the internet before the fix was ready.
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two memory-safety bugs, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4 scale, PHP said in its advisory. The project called updating “the only safe choice”. It said the risk is highest for sites running Apache with mod_php, where an unauthenticated request can trigger the flaw before any application code runs.
What makes the release unusual is how the bugs surfaced. Security firm Calif found the first one in August, with help from OpenAI’s GPT-5.6 Sol model. It came during an audit of PHP’s source code that OpenAI funded through its Patch the Planet initiative. Google’s Wiz team said it found the flaws independently, weeks later. It used Wiz Atlas, Google’s Gemini 4 Argon and GPT-5.6 Sol. PHP’s advisory credits researchers from Calif, Wiz and OpenAI together.
The companies disagree on what it means
OpenAI framed the find as proof that AI can catch internet-scale flaws before criminals do. It calls this a Defender’s Window.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI wrote.
The company has committed $1bn in subsidised access to its Daybreak cyber programme for under-resourced defenders. Calif struck a more measured note. In its own write-up, the firm said it used only generally available models and no special tooling. Knowing PHP’s history, it said, mattered more than the model.
“No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,” the company wrote.
OpenAI models helped researchers discover critical security flaws in PHP.
OpenAI (@OpenAI) October 21, 2026
Websites went dark before the patch
Governments and companies did not wait. The EU’s cyber agency CERT-EU and Britain’s NCSC both advised organisations to take systems offline where they could not patch at once. The US National Security Agency issued its own alert. The bookmarking service Pinboard, the GrapheneOS forum and the streaming tool OBS pulled parts of their sites down. Laravel halted its Cloud deployments while it rebuilt on patched images.
The release also came early. PHP had scheduled it for 14:00 UTC, with a wider embargo due to lift the next day. It brought the fix forward after details leaked in a post to Hacker News, the Wall Street Journal reported. Security firm watchTowr confirmed the bugs were real before any patch existed. A proof-of-concept exploit then circulated online.
Volker Dusch, a security engineer at the nonprofit PHP Foundation, told the Wall Street Journal it was the most severe issue PHP had faced in more than a decade. He likened it to Heartbleed, the 2014 bug that forced a global patching race. Wiz compared the flaws to both Heartbleed and Log4Shell. It estimates PHP runs roughly 70% of all websites.
A decade of exposure
PHP did not name the oldest affected version. But Calif, Wiz and Cloudflare all put the reach at PHP 5.4 and later, more than a decade of releases. PHP’s team published backported fixes for the unsupported 7.4, 8.0 and 8.1 branches, given the severity. It warned that no configuration change is a complete substitute for updating. WordPress, which runs on PHP, urged site owners to update. It noted that versions before 8.2 no longer receive security fixes.
Infrastructure providers moved to blunt attacks in the gap. Cloudflare said it switched on web application firewall rules for every customer, free accounts included, at 03:02 UTC. That was about nine hours before disclosure, the company said. It watched attackers mutate their payloads against the rules as they landed.
PHP changes are live. Start patching. Huge thanks to coordinated work by @ThePHPF!
Dane Knecht (@dok2001) October 21, 2026
This is the second time in months that AI-found flaws in web software have forced a mass update. The mass-exploited WordPress bugs came in July. OpenAI said the PHP flaws are among several serious vulnerabilities it has already found. It expects “similar findings to increase sharply” in the coming months. For now, the only fix PHP endorses is the update itself.