PHP patches two critical flaws that could let attackers take over servers

PHP is a free, open-source programming language that much of the web is built on. Wired says it has grown from the 1990s into an essential scripting language for websites and software.

Publishing systems like WordPress and Drupal run on it, and so does the e-commerce platform Magento. AppleInsider adds Joomla to that list.

The big picture: CNET cites the Wall Street Journal, which says the flaws could affect up to 70% of the world's websites. That is an estimate from the outlet, not a count from the PHP project.

The PHP project published both advisories on its website. Each one is rated 9.2 out of 10 for severity.

• CVE-2026-109618: out-of-memory handling can interrupt PHP while internal request data is only partly set up. Cleanup may then treat that broken data as valid.
• CVE-2026-109619: request-owned internal state can outlive the memory behind it. A later request handled by the same worker may use that stale state before it is reset.

Both can lead to remote code execution, which means an attacker makes your server run their commands. The PHP project says the risk is highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any application code runs.

In real life Imagine a shop where every customer's note gets handled at the same counter. These bugs let a stranger slip a note that makes the counter staff do what the stranger wants, before anyone checks who they are.

The PHP project says the flaws affect all PHP installations serving web requests. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

Wired reports the flaws go back to PHP 5, released in July 2004. Only PHP 8.2 and newer still get patches, which is where the trouble sits.

The catch: Wired points out that foundational web layers like PHP can sit forgotten in old infrastructure. A server nobody has touched in years may still be reachable from the internet.

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The PHP project says Linux distributions and long-term support vendors received the patches in advance, so check your vendor for updated packages.

For PHP 8.1 and older, the project no longer ships updates. Its security team provided minimal source backports for PHP 7.4, 8.0 and 8.1, and some vendors offer their own fixes, so the advice is to contact your vendor or move to a supported version.

"There are no complete mitigations, updating is the only safe choice," the PHP Foundation wrote in its advisories, as quoted by Wired.

The PHP project lists partial measures, and it is blunt that they do not make an installation safe. They only reduce exposure to specific attack paths.

• Memory limit: set memory_limit to -1 in a way applications cannot override, such as php_admin_value in the FPM pool or the Apache configuration.
• Upload size: set a low post_max_size, 8M for apps that need no uploads or 32M for those that do.
• Session progress: set session.upload_progress.enabled to 0 and restart every worker.
• PHP 8.5: set fatal_error_backtraces to 0, which blocks one confirmed path.

The PHP project also suggests limits at the web server or proxy, covering decoded request size, input field count, multipart part count, header count and nesting depth. Those limits should apply to requests without a usable Content-Length too.

For availability, it recommends a container or cgroup limit that kills only the affected worker. It warns against using RLIMIT_AS or RLIMIT_DATA, since those can cause the vulnerable allocation failure.

Treat that list as a bandage while you schedule the real update.

Cloudflare says yes. CNET reports that Cloudflare's chief technology officer, Dane Knecht, said the company deployed a firewall fix but was still seeing early attacks emerging.

Wired says Cloudflare reported early attacks before the PHP Foundation had even detailed the flaws. The security firm Sansec wrote ahead of the release that it expected mass attacks within 15 minutes.

Wired also cites reports from Bleeping Computer and Ars Technica that some details may have leaked before the official release. The PHP site had warned it could release early if details became public or if exploitation appeared in the wild.

The PHP project gave advance notice on October 20 without naming versions or details. Agencies then told teams to get ready.

• UK NCSC: organizations should prepare for immediate updating and consider taking systems offline until they are fully fixed.
• CERT-EU and Australia's ACSC: both told IT teams to be ready to update, with the possibility of temporary downtime.
• NSA Cyber: posted an advisory urging organizations that use PHP to prepare for the update.
• FBI: cyber assistant director Brett Leatherman asked victims to isolate systems, keep web server and PHP logs, and report to a local FBI field office.

Security consultant Lukasz Olejnik told Wired, "This is not a drill," and warned that the worst case is wormable malware. Consultant Davi Ottenheimer described the bug as a front door with no lock, since one crafted upload to any server is the whole attack.

OpenAI said in a blog post that its GPT-5.6 Sol model discovered the vulnerabilities, according to CNET. OpenAI added that Wiz identified them independently.

Wired reports that Wiz says it used AI tools in part, and that OpenAI and Calif say they found the issues independently and then worked together. Wiz also built a demonstration it calls php2shell and says the flaws can sometimes be exploited fairly easily.

Wiz writes that attackers could execute code on affected servers or read sensitive process memory. That memory may hold passwords, tokens, API keys and certificates.

Why it matters: OpenAI said this incident shows how AI can uncover security flaws with internet-scale impact. The same abilities can help attackers build exploits quickly. For another side of AI and bug reports, see our story on Google pausing its open source bug bounty.

• If you run a website: ask your host or developer which PHP version you use, and update to a fixed release today.
• If you use WordPress or similar: the fix is at the server level, so check your hosting provider's notices, not only plugin updates.
• If you run old PHP: versions before 8.2 get no regular patches, so contact your vendor or plan an upgrade.
• If you only browse: nothing to install, but expect some sites to go down briefly while they patch.