OpenAI, in collaboration with researchers from Calif and Wiz, identified two critical vulnerabilities in the PHP engine on October 21, 2026. These flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are assigned a CVSS score of 9.2.
The vulnerabilities allow for remote code execution and unauthorized memory disclosure without requiring authentication. They affect PHP versions dating back to 5.4.0, potentially impacting approximately 70% of websites that utilize PHP, including platforms like WordPress, Drupal, and MediaWiki.
The discovery was facilitated by OpenAI’s Codex Security tool. The research team verified the remote code execution behavior on WordPress and Drupal in August 2026. The disclosure process involved coordination with major infrastructure providers, including AWS, Google Cloud, and Microsoft.
The root causes of the vulnerabilities are related to memory safety, specifically how PHP manages out-of-memory scenarios and stale global states across requests. A patch was developed and released before the vulnerabilities could be exploited by malicious actors.
Operators of PHP-based websites are advised to update to the latest patched versions immediately. Failure to address these security flaws could result in significant data breaches, loss of user trust, and financial consequences for affected businesses.
