PHP emergency release and the CVEs involved
On 10/21/2026 at 9:55 a.m., the PHP project shipped emergency patches across supported branches: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering branches 8.2 through 8.5. The release addresses two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4.0 scale. Researchers have labeled the set of flaws “php2shell.” The PHP team said the full technical advisory and definitive list of affected releases would be published with the release; until that advisory appears, the project has not officially confirmed the technical root cause or a complete list of affected versions.
Cloudflare, exploit video and early attack activity
Cloudflare moved quickly after public signs of exploitation. Dane Knecht said the company was “seeing early attacks emerging,” and Cloudflare deployed firewall rules to cover known exploit vectors for all customers — including free accounts — while calling that mitigation “a stopgap.” A video demonstrating an exploit chain circulated online, shared by researcher Kirill Firsov, who credited researchers known as LCFR and Calif.io. The security firm watchTowr reported it had reproduced one of the flaws. Code claiming to exploit the vulnerabilities is circulating, but analysts warned such code is sometimes laced with malware and has not been independently verified in all cases.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAI companies and coordinated discovery: OpenAI, Calif and Wiz
The vulnerability discovery and disclosure involved multiple AI security teams. The flaw was discovered by AI cybersecurity firm Calif using OpenAI’s cybersecurity‑focused model GPT‑5.6 Sol, the OpenAI blog said. Wiz — an AI security firm purchased by Google in March — also independently discovered and reported the flaw, according to OpenAI. OpenAI described a two‑month collaboration among OpenAI, PHP maintainers, external researchers and security providers to build a long‑term technical fix and coordinate public disclosure. OpenAI urged organizations to apply the new patches and offered a free tool and other support to help identify vulnerable versions. OpenAI wrote that, “to our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.”
Wiz analysis: AI lowering the bar for complex exploits
Researchers at Wiz said they had discovered “multiple critical vulnerabilities” in PHP using GPT‑5.6 Sol, their Wiz Atlas AI tool, and Google’s Gemini 4 Argon. Wiz described the underlying bug as a decades‑old, technically arduous memory‑safety issue that previously made exploitation impractical for most attackers. According to Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, AI can now adapt exploits to different PHP versions, configurations and memory layouts, reducing the specialist effort required to develop and tune an exploit — a shift the researchers said “changes the economics of both discovery and exploitation.”
Scope of exposure: hosts, versions and platform impact
The potential exposure is broad. Market research cited in reporting estimates PHP runs between 70–80% of websites whose server‑side language is known and underpins platforms such as WordPress, Drupal, Joomla and Laravel. Researchers estimated more than 1.3 million internet‑exposed hosts could be vulnerable; a Shodan search counted roughly 1.9 million. VirusTotal data showed that among servers that disclose their PHP version, about 758,000 run versions from 5.4 through 8.1 — many of which no longer receive security updates — versus about 272,000 on supported branches. CERT‑EU warned the flaws could affect every version of PHP from 5 onward.
What CERT‑EU, Britain’s NCSC and hosting operators are advising
CERT‑EU and Britain’s National Cyber Security Centre advised organizations to prepare to update systems quickly and suggested isolating internet‑facing applications where immediate patching was not feasible. Security firms including Huntress and Tenable said they would update their analyses as technical details and proof‑of‑concept code emerge. Cloudflare’s firewall rules and the public distribution of mitigations by multiple vendors reflected a common defensive posture: protect known vectors centrally while urging systemic patching where possible.
The PHP emergency release resolves an immediate, high‑severity threat whose exploit code and demonstration material had already surfaced publicly. The rapid, collaborative discovery and remediation — involving AI tools, open‑source maintainers and commercial security teams — illustrates both a new defensive capability and a new operational tempo for vulnerability disclosure. The concrete next step in this story is contained in the PHP release itself: apply these updates to affected systems and review any vendor or CERT guidance tied to your PHP deployment. More technical details were promised with the advisory published alongside the patches.
