On Wednesday 21 October 2026 at 14:00 UTC, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on the CVSS v4.0 scale, which can allow unauthenticated remote code execution. According to the publisher, all installations serving web requests are affected, under PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed, and the risk is considered highest with mod_php.

The same day, CERT-FR updated its alert CERTFR-2026-ALE-014 and the Interior Ministry shut down its exposed sites, including prefectures. The timeline published by the PHP Foundation shows that the defect behind the first flaw had been identified since 2024, without a known exploitation vector. This summer, researchers, some claiming to use AI models, demonstrated its severity in a few weeks.

A defect spotted during the 2024 audit, left unfixed

In a post published on 21 October, the PHP Foundation recounts the history of CVE-2026-109618. In 2024, PHP underwent its first external security audit in years, funded by the German Sovereign Tech Agency, organised by OSTIF and carried out by the French company Quarkslab. While fixing one of the reported issues, a PHP core developer spotted the first signs of a defect related to out-of-memory errors. Exploitation was theorised at the time, without a concrete vector.

The fix then stalled over trade-offs. Each approach considered broke compatibility, opened a risk of denial of service or required changes to many third-party extensions, impossible to coordinate. The security team, which decides by consensus, saw the project "stall and restart several times over months". The foundation writes that "the delay was a structural failure", due to the team's decision-making process and its lack of resources (quotes translated from English).

Calif, OpenAI and Wiz: the summer when exploitation was proven

As part of the Patch the Planet programme, the company Calif began an audit of PHP on 30 July 2026. On 11 August, its researcher Ryan A. reported an unconditional remote code execution, with the same root cause as the 2024 defect. OpenAI, whose Codex Security team is credited by the foundation, independently reported the same cause the same day. Wiz Research followed on 24 August with other attack vectors, and OpenAI again on 18 September. From 11 August, the foundation writes, the fix became the priority of its entire security team.

Wiz details in its "PHP2Shell" post the role of models in its work. The team says it used its Wiz Atlas tool, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Its timeline places the discovery of the first flaw on 19 August, code execution confirmed on 20 August on Drupal and on 21 August on WordPress, and the report to PHP on 24 August. Demonstrating the exploitability of these defects, present in the code for over ten years, required according to Wiz a chain of steps "at the limit of what human researchers could practically accomplish". With the models, still according to the company, a single researcher completed in one week what would have taken a top team months.

The foundation also quantifies the influx of reports, with 15 CVEs published since 1 July and over 100 reports dismissed as invalid, duplicates or non-reproducible. PostgreSQL is seeing a comparable increase, with 44 flaws fixed in 2026 compared with 7 in 2025.

A coordinated disclosure disrupted by a leak

The release was scheduled for 22 October. On 20 October around 15:00 UTC, the two CVE identifiers began circulating on forums and social networks, with an incorrect release time and a false CVSS score of 10. No technical details leaked, according to the foundation. PHP brought forward its pre-announcement, published at 19:30 UTC, and the release to 21 October. Calif then mistakenly posted a video of its proof of concept: it was removed, but had been copied and, according to the foundation, helped accelerate the development of proofs of concept. On 21 October at 07:41 UTC, Chainguard published images incorporating the fix more than six hours before the release, which the foundation calls a unilateral breach of the embargo.

Isolate then migrate: ANSSI's instruction

CERT-FR lists as affected all versions 5.x, 6.x, 7.x, 8.0.x and 8.1.x, as well as branches 8.2 to 8.5 prior to the fixed versions. For branches no longer maintained by the publisher, it recommends isolating the equipment and then migrating to a maintained and fixed version. The temporary workarounds it mentions, in PHP configuration or on a web application firewall, are "not qualified" by CERT-FR. The PHP project states that no mitigation is complete and only the update resolves the issue.

In a communication dated 21 October reported by Global Security Mag, ANSSI (France's national cybersecurity agency) indicates that more than 600,000 servers use PHP on the French internet and recalls that CERT-FR recommended, where possible, taking the affected servers offline until the patch is applied. The Interior Ministry proceeded, at the agency's request, "to the preventive maintenance of all its websites exposed to a critical security vulnerability", according to a ministry statement reported by AFP. According to Actu17, some prefecture sites were no longer responding from 14:00 Paris time, about two hours before the patch was released.

On 22 October at 08:33 Paris time, the CNIL (France's data protection authority) website returned a page saying "The CNIL website is currently under maintenance", impots.gouv.fr indicated it was "currently under maintenance" and the Seine-Saint-Denis prefecture website displayed "Maintenance in progress". None of these pages mention PHP.

Attack attempts observed, no confirmed intrusion

Cloudflare says it observed attack traffic targeting its customers, and attackers modifying their requests to bypass its filtering rules, active by default since 21 October at 03:02 UTC. The PHP Foundation, which examined the proofs of concept that appeared after the leak, had not identified any working exploit at the time of publication. On 22 October at 08:35 Paris time, the two CVEs were not listed in the CISA Known Exploited Vulnerabilities catalog, in its version of 21 October at 14:04 UTC. As of that date, none of these sources reported a successful intrusion.

For CIOs, unsupported versions become the weak link

The episode undermines an assumption on which many patch policies rest: a known defect without a demonstrated exploitation vector can wait. At PHP, this one waited from 2024 to summer 2026 for lack of a decision. Between 11 and 24 August, three teams reported it, two with demonstrated code execution, and Wiz, which claims to use AI models, confirmed code execution on Drupal the day after its first discovery. ActuIA has noted similar signals in recent weeks, from the exploit of known flaws reproduced in 28 minutes by Claroty to the hacker who breached over 100 companies with AI agents.

Maintained branches received their patch on the day of disclosure, and distributions had it in advance. The main risk concerns servers still running PHP 8.1 or earlier in production. The PHP project no longer updates them; given the severity, its security team still provided minimal backports for PHP 7.4, 8.0 and 8.1, intended for those who compile from source, and some long-term support vendors are publishing their own patches. For others, CERT-FR's instruction remains isolation then migration, a project that cannot be completed within the time left by this disclosure.

The PHP Foundation is asking companies, hosting providers and government agencies that rely on PHP to fund its teams. The security of the engine still depends, it writes, on "a small group of developers funded by the foundation and a little volunteer help".

Our articles will then appear first in Google Top Stories.