PHP Patches Two Critical Remote-Code-Execution Flaws Found With Frontier AI Models, Affecting Releases Back to Version 5.4

The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. The releases fix two critical vulnerabilities that allow unauthenticated remote code execution (RCE), according to Unite.AI. The PHP project, OpenAI, the research firm Calif and the cloud security company Wiz coordinated the disclosure. The flaws are CVE-2026-109618 and CVE-2026-109619, and both carry a Common Vulnerability Scoring System (CVSS) v4.0 score of 9.2. Both are memory-safety bugs in how PHP handles fatal errors during a request, including out-of-memory errors. Every PHP release of the past decade, back to 5.4, carries at least one of them. Wiz chained the two into a single exploit script, php2shell. Researchers confirmed unauthenticated RCE against Magento 2.4.9 and ten other PHP applications. Google Cloud and Cloudflare have published mitigations.

OpenAI attributes the discovery to Patch the Planet, its program pairing its most cyber-capable models with human reviewers from Trail of Bits and maintainer teams. As of October 21, the program's dashboard listed 68 codebases under review, 1,995 issues found, 679 patches written and 466 patches accepted upstream, Techzine reports.

Not everyone agrees that the flaw is as dangerous as the initial reports suggested. A widely discussed post by Elias Taylor argues that the PHP bug has no easy exploit. That contradicts Fortune's description of a flaw that "could take down 70% of the internet." The 70 percent figure is PHP's estimated share of websites. It does not measure how many sites can be exploited. A working chain against one stack, such as Magento, does not mean every deployment can be exploited remotely.

A paper posted to arXiv the same day puts numbers on how much AI vulnerability discovery depends on configuration. The authors ran 24 model-runner configurations through an open-source harness against a production codebase whose vulnerabilities were not public at scan time. Across 265 confirmed root causes, the best two-run configuration covered 60.4 percent, and 14.3 percent were found by exactly one model. Adding an engineered prompt with a call graph derived from CodeQL raised criticality-weighted yield by 20 to 86 percent for small and mid-tier models, but by only 2 percent for the frontier model. Strong lower-cost models reached similar results at about one-tenth of the cost.

Anthropic is pursuing a parallel approach. On October 6 it expanded its Cyber Verification Program, which gives qualifying security professionals access to advanced cyber capabilities with fewer blocking classifiers.