PHP Releases Critical Security Fixes for Two Remote-Code-Execution Flaws
By Asymmetric Analytics
Analysis
PHP released security updates on October 21 for two flaws that can permit attackers to execute code remotely without signing in. Its maintainer advisory identifies fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and urges immediate updates.
Remote code execution means an attacker may run instructions inside the affected server process. It does not mean every installation has been attacked or that every configuration presents an identical path.
What is affected
The flaws are CVE-2026-109618, involving interrupted initialization during out-of-memory handling, and CVE-2026-109619, involving stale request state after memory is freed. Both are rated 9.2 under CVSS 4.0.
The first technical advisory documents a demonstrated Apache modphp attack before application code runs. The second also validates an application-dependent PHP-FPM path. Moving from Apache to FPM therefore cannot be treated as a complete fix.
PHP identifies web-serving installations broadly as at risk. Its temporary measures reduce particular paths; they do not replace patched software. Older branches lack routine upstream support, but PHP has supplied exceptional minimal source backports for 7.4, 8.0 and 8.1. Operators should reconcile their running runtime with their distributor's advisory and backport records.
Attempts are different from compromise
Cloudflare reports attack traffic and changing payloads following a leak of vulnerability information. That is a participating security vendor's account of attempts. AA has not independently verified its telemetry; the sources reviewed do not establish a count of successfully compromised systems.
The distinction matters: widespread use of PHP does not measure vulnerable servers, reachable attack paths or successful intrusions.
AI helped the researchers; maintainers supplied the fixes
OpenAI says security researchers at Calif used GPT-5.6 Sol to identify a critical flaw and Wiz independently reported both issues. Google Cloud and Wiz describe human researchers working with multiple models, including Gemini 4 Argon. These are the participants' accounts. PHP maintainers led the fixes; the accounts do not establish that a model worked alone.
Why this matters
A shared runtime can create simultaneous operational work across unrelated businesses. The plausible financial channel is engineering time, rollout risk and possible interruption where exposed services support commerce. This reporting establishes no specific business loss or market-price response.
Patch availability begins protection; verified deployment determines how much exposure remains. Google describes automatic updating for supported App Engine Standard workloads and eligible Cloud Run base images. Provider automation can shorten that gap, although AA has not independently checked those fleets.
What to watch: confirmed compromise reports, distributor patch availability, verified running-runtime coverage and time from release to completed rollout.
Sources
PHP stale-state technical advisory .
OpenAI coordinated-disclosure account .