The PHP Foundation has released security patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to address two critical vulnerabilities. Versions 8.1 and older will not receive official updates. The release was moved to October 21, 2026, following premature disclosures.
Researchers from the firm Calif and OpenAI identified the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, using AI tools. These vulnerabilities, which received a severity score of 9.2 out of 10, allow remote code execution without login credentials and can expose sensitive data like passwords and API keys.
The underlying issues involve how the PHP engine manages memory and handles errors. While the Foundation had been aware of the flaw since 2024, human developers were unable to identify an exploitation method or a fix. AI-assisted researchers successfully demonstrated working exploits within two weeks.
OpenAI framed this discovery within its Defender's Window concept, which advocates for using advanced AI to find and patch vulnerabilities before such capabilities become accessible to malicious actors. The company notes that these flaws exist in the core PHP engine, potentially affecting a vast number of websites.
