Security updates have been released for two critical vulnerabilities in PHP’s core engine that could allow attackers to take control of vulnerable web servers without authentication. The fixes, published on October 21, 2026, address flaws that went undetected for more than a decade and could affect websites running popular platforms including WordPress, Drupal, and Joomla.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both carry a critical severity rating of 9.2 out of 10. PHP has released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators urged to update immediately. Wiz Research discovered the flaws alongside contributions from Calif and OpenAI. The researchers combined the vulnerabilities into an exploit chain known as PHP2Shell, demonstrating remote code execution against WordPress, Drupal, and Joomla without requiring authentication.
What the bugs do
Both vulnerabilities stem from the way PHP handles fatal errors — particularly out-of-memory conditions — while processing web requests. When a request ends unexpectedly, PHP can leave corrupted internal state behind. A subsequent request or worker process may then reuse that stale state, opening the door to memory disclosure or arbitrary code execution.
CVE-2026-109618 involves a use-after-free condition in PHP’s upload-progress unserializer. An attacker can trigger it to read sensitive data from a PHP worker’s process memory, which may include passwords, authentication tokens, API keys, and certificates, or corrupt memory to achieve remote code execution. The researchers demonstrated pre-authentication RCE on WordPress, Drupal, and Joomla through this bug alone. CVE-2026-109619 is a separate use-after-free in PHP’s fatal-error backtrace handling, combined with an OPcache type-confusion issue. It provides another path to memory corruption and code execution, with pre-authentication RCE demonstrated independently against both WordPress and Drupal.
Scope of exposure
PHP powers a vast share of the web, running the software behind WordPress, Drupal, Joomla, MediaWiki (including Wikipedia), and countless other platforms. Wiz estimates the language is used by roughly 70 percent of all websites worldwide.
Security firm Sansec confirmed that the exploit works against an extensive list of popular applications, including Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS, all without requiring an attacker to authenticate. Sansec warned administrators to update PHP on every server immediately, noting that exploit tooling and detailed writeups are now public.
Even trivially simple PHP applications are at risk. Wiz noted that a basic “Hello World” script running on an affected PHP version could be exploited, since the flaws exist in the engine’s request-handling machinery rather than in application logic. Wikimedia’s Phabricator instance was taken offline as a precaution ahead of the patch, according to Wikipedia’s article on the vulnerabilities.
AI’s role in uncovering the flaws
Wiz described the discovery as a turning point for AI-assisted security research. The vulnerable code had been present in the PHP codebase for over a decade, but building a working exploit required chaining multiple bugs and adapting to each target’s memory layout. Researchers said this work was at the edge of what human analysts could practically achieve alone.
Frontier AI models substantially lowered that barrier. Wiz reported using its own Atlas platform alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol throughout the research, with Gemini 4 Argon contributing to vulnerability discovery, exploit development, attack detection, and patch validation. The company cautioned that as AI continues to reduce the effort needed to develop and adapt complex memory-corruption exploits, flaws once considered impractical to weaponize may become viable targets. This could change how security researchers and organizations assess exploitability.
Coordinated industry response
Before public disclosure, Wiz coordinated with the PHP team, Calif, and OpenAI on patch development and verification. A broader industry effort brought in Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel, and others to prepare customer guidance, web-application firewall rules, and mitigations for organizations unable to patch immediately.
Elastic Security Labs published detection guidance focused on identifying post-exploitation behavior, such as PHP worker processes taking actions abnormal for a request-serving daemon. Community-contributed detection rules for Suricata, Sigma, and ModSecurity have also appeared on GitHub. Wiz noted that while it reported four distinct exploitable bugs grouped under the two CVEs, additional variants of the same underlying pattern likely exist in PHP’s codebase.
The patch released by the PHP team on October 21 addresses the root cause, eliminating all known variants in the patched releases. Organizations running any PHP version from 5.4 onward should update without delay.
Leave a Reply