Two PHP Flaws Surfaced With AI's Help. Time to Update Your Servers
The PHP project has patched two vulnerabilities that can let an attacker run code on a server without authenticating. Anyone operating a PHP server in Korea should check which version they are running and whether their vendor has shipped a fixed package.
On October 21 local time, the PHP project released updates fixing two serious security vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Researchers demonstrated that, under certain conditions, an attacker could execute code on a server without going through any authentication step such as a login. Both flaws carry a severity score of 9.2 out of 10.
Which servers need the update
The PHP project recommends the update for every PHP installation that handles web requests. It specifically noted that in “mod_php” setups, where PHP is embedded in the Apache web server, the attack was possible before any site-specific code even ran. In other words, it occurs at a stage where even thorough review of a site’s own code would struggle to block it.
Both defects arise in the way the server manages the memory it uses for its work. One occurs when the memory limit is reached and incompletely initialized internal data gets treated as if it were valid. The other involves information pointing to memory that was already used and released during an earlier request lingering into the next one. Researchers showed that these two defects could lead to a remote attack under specific conditions.
It was known back in 2024. Why the delay?
According to the PHP Foundation, the first signs of the memory limit issue, one of the two defects, were spotted during an external security audit in 2024. At the time, no concrete attack path leading to code execution on the server had been confirmed. Fixes were further delayed by concerns that a patch could break existing software or hurt performance. The foundation acknowledged a structural failure rooted in its security team’s decision-making process and a shortage of people.
What turned the theoretical risk into a concrete attack was follow-up security research. The security firm Calif began its review on July 30, 2026, and reported a working attack path on August 11. OpenAI and Wiz also reported related paths. The researcher said AI tools helped in analyzing the vulnerability.
The PHP Foundation said the severity score of 10.0 that leaked before disclosure was incorrect, and that the actual score is 9.2. It also said that as of the release of the fixed versions, it had not identified any working external exploit code.
What administrators in Korea should do
The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. As of October 21, administrators can download those versions or update via fixed packages from their operating system distribution. The PHP project states explicitly that configuration changes alone cannot fully block the vulnerabilities and that updating is required.
Servers operated in Korea are equally in scope if their PHP handles web requests. Administrators should confirm the PHP version in use and also check for fixed packages released by their OS distribution or vendor. PHP 8.1 and earlier have reached the end of the project’s regular support. In those cases, users need to verify whether their distribution or a long-term support vendor has issued a separate fix.
This is a case where AI was used in research that revealed the real-world exploitability of a long-standing defect. At the same time, the patching delay the PHP Foundation admitted to shows how much the response process after a defect is found matters. For organizations running web services on PHP, applying the fixed release is the immediate task. Next comes watching post-disclosure attack activity and how quickly each vendor rolls out its fixed packages.