# PHP Ships Emergency Patches for Two Critical Remote-Code-Execution Flaws That an OpenAI Audit Helped Find

The two bugs score 9.2 out of 10, may expose more than a million internet-facing servers, and pose the highest risk to Apache servers running mod_php.

- Published: 2026-10-23T06:19:29.884Z
- Canonical: https://polylog.news/ai/2026-10-23/php-ships-emergency-patches-for-two-critical-remote-code-exe
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [The Next Web](https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz), [ROIC News](https://www.roic.ai/news/critical-php-flaws-expose-over-a-million-systems-to-remote-code-execution-10-21-2026), [ABC7 News](https://abc7news.com/story/urgent-security-fix-issued-code-vital-estimated-70-websites/19965216/)

The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. The releases fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution and memory disclosure,…

This story is for subscribers. Read it in full at https://polylog.news/ai/2026-10-23/php-ships-emergency-patches-for-two-critical-remote-code-exe (subscription information: https://polylog.news/pricing).