AI discovers critical PHP flaws affecting 70% of the web

On October 21, 2026, the PHP development team released emergency patches for critical vulnerabilities in the core language engine. Wiz Research discovered these flaws using advanced artificial intelligence, revealing that nearly every PHP version released in the last ten years is susceptible to remote code execution or sensitive data theft. The findings impact an estimated 70% of all websites globally, including major platforms like WordPress, Drupal, and Wikipedia.

What happened

Wiz Research identified multiple severe memory-safety issues within the PHP core itself, independent of any specific application running on top of it. These vulnerabilities, tracked under CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code on affected servers or read process memory containing passwords, API keys, and authentication tokens. The bugs stem from how PHP handles fatal errors, particularly out-of-memory conditions, during request processing. When a request fails unexpectedly, internal state can become corrupted, leaving dangling pointers that subsequent requests may inadvertently reuse.

The discovery marks a significant shift in vulnerability research. While the flawed code had existed for over a decade, demonstrating its exploitability required chaining complex memory corruption primitives across different PHP versions and configurations. Previously, this level of analysis would have demanded months of effort from a large team of elite security researchers. In this case, frontier AI models enabled a single researcher to develop working exploits in just one week. The coordinated disclosure involved collaboration with the PHP team, OpenAI, Calif, and major cloud providers to ensure mitigations were ready before public release.

How it works

The vulnerabilities arise from race conditions and state management errors during error handling. One bug involves the session upload-progress handler. If an out-of-memory error occurs while decoding session data, the global unserializer state remains published even after the request heap is destroyed. A later request handled by the same worker process can reclaim that freed memory, tricking PHP into treating attacker-controlled data as valid internal bookkeeping. This use-after-free primitive allows for memory corruption and, when combined with information leakage, leads to remote code execution.

Another vector involves the fatal-error backtrace mechanism. PHP retains the backtrace of the last fatal error in a global variable. If a fatal out-of-memory error destroys the request heap without clearing this global pointer, the worker survives with a dangling reference. When the next request triggers a diagnostic output, PHP accesses this stale pointer, which now points to attacker-reclaimed memory. This cross-request use-after-free enables controlled memory corruption. Additionally, type confusion in OPcache shared memory allows attackers to corrupt shared state across different worker processes, further facilitating exploitation on platforms like WordPress.

Key details

• Scope: Affects PHP versions dating back to 5.4, impacting approximately 70% of all websites.
• Severity: CVSS score of 9.2, allowing unauthenticated remote code execution and memory disclosure.
• Discovery Method: Frontier AI models (Gemini 4 Argon, GPT-5.6 Sol) reduced exploit development time from months to weeks.
• Impact: Demonstrated exploitation on WordPress, Drupal, and Joomla without requiring application-level flaws.
• Patch Date: Official fixes were released by the PHP team on October 21, 2026.
• Collaboration: Coordinated with AWS, Cloudflare, Google, Microsoft, and others for widespread mitigation.

Why it matters

For software engineers and infrastructure leads, this incident underscores that legacy codebases harbor deep, systemic risks that traditional auditing often misses. The fact that these bugs existed for ten years without detection suggests that many other foundational libraries may contain similar latent vulnerabilities. The reliance on PHP for critical web infrastructure means that even secure application code cannot protect against flaws in the underlying runtime environment. Teams must assume that their dependencies are vulnerable until proven otherwise and prioritize rapid patching cycles.

The role of AI in this discovery changes the threat landscape permanently. Complexity is no longer a reliable defense mechanism. If AI can chain obscure memory bugs into working exploits in days, attackers will soon possess the same capability. This shifts the advantage from those who hide complexity to those who can automate detection and remediation at scale. Security strategies must evolve to include AI-assisted vulnerability scanning and runtime protection, as manual code review alone is insufficient for identifying these deep engine-level flaws.

What you can do

• Update your PHP installation to the latest patched version released on October 21, 2026, immediately.
• If immediate patching is not possible, deploy web application firewall rules to block unusual multipart requests and monitor for HTTP 500 errors.
• Review server logs for signs of exploitation, such as unexpected PHP worker churn or malformed session cookies.
• Enable runtime application self-protection (RASP) or similar tools that can detect memory corruption behaviors.
• Audit your dependency chain to identify all services running affected PHP versions, including containerized environments.
• Implement strict memory limits and monitoring to detect out-of-memory conditions that could trigger these vulnerabilities.