AI Uncovers 10-Year-Old PHP RCE Zero-Days: Emergency Patches Out
Frontier AI models have uncovered two remote code execution zero-day flaws hidden in the PHP core engine for over a decade, requiring immediate runtime updates regardless of application-level defenses.
The PHP development team and The PHP Foundation issued emergency security updates on Oct. 21 to address two critical remote code execution (RCE) flaws in the core PHP runtime. Dubbed “PHP2Shell,” the vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a maximum-severity CVSS v4.0 score of 9.2 (Critical), allowing unauthenticated remote attackers to execute arbitrary code with web server privileges using crafted HTTP requests.
The flaws were not discovered through manual code audits, but rather by security researchers deploying frontier AI models to inspect low-level C codebases. Frontier AI refers to the most advanced AI models.
A decade-old PHP core flaw uncovered by AI
Security firm Calif and cloud security provider Wiz independently identified the vulnerabilities and reported them privately in August 2026. The Calif team discovered the defects by tasking OpenAI’s GPT-5.6 Sol reasoning model with static analysis and memory-safety verification across the PHP interpreter.
OpenAI used the discovery to spearhead its “Patch the Planet” initiative. The project aims to mobilize AI for defensive cybersecurity, helping maintainers and critical infrastructure operators identify and patch severe vulnerabilities before attackers can weaponize them.
Both bugs had lingered in PHP core code since PHP 5.4, persisting undetected across every release up through PHP 8.5. Because the flaws reside along deeply nested error-handling and global cleanup routines, traditional fuzzing tools and conventional human reviews had missed them for more than ten years.
OOM corruption and stale global state: how the flaws work
Both vulnerabilities exploit weaknesses in how the PHP runtime manages memory allocation and handles fatal error recovery.
The first vulnerability, CVE-2026-109618, stems from out-of-memory (OOM) handling. When a script hits its configured memory_limit, PHP invokes longjmp() to abort execution and clean up request state. However, if an allocation failure occurs while parsing incoming multipart form data or file uploads, internal request structures remain only partially initialized. During cleanup, PHP mistakenly treats these invalid pointers as valid memory allocations, triggering heap corruption that attackers can reliably hijack to gain execution control.
The second vulnerability, CVE-2026-109619, involves global state leakage across request lifecycles. To optimize performance, the PHP core allows certain global pointers to reference request-allocated memory. When an unhandled error interrupts execution, these global pointers can remain uncleared, creating a classic use-after-free condition. When the same worker process handles a subsequent request, it references the stale pointer before initialization completes, allowing an attacker to corrupt memory or leak process data.
Server runtime impact and the risks of EOL branches
Because these vulnerabilities live inside the PHP interpreter runtime itself, application-level defenses provide zero protection. A web application built on WordPress or Laravel with pristine, hardened PHP code remains entirely vulnerable the moment the web server passes incoming requests to an unpatched PHP engine.
The attack surface varies depending on the server architecture:
- Apache mod_php: This represents the highest-risk configuration. PHP runs directly inside the web server’s process memory without process isolation, allowing unauthenticated requests to compromise the daemon immediately.
- PHP-FPM and FastCGI: Because worker pools routinely handle multiple requests over their lifetime, attackers can trigger an OOM condition to corrupt a worker and then follow up with a secondary request to execute arbitrary code.
The distribution of upstream fixes poses an even larger operational dilemma:
| Branch | Status | Patched release |
|---|---|---|
| PHP 8.5 | Active | 8.5.12 |
| PHP 8.4 | Active | 8.4.27 |
| PHP 8.3 | Security-only | 8.3.36 |
| PHP 8.2 | Security-only | 8.2.35 |
| PHP 8.1 and earlier | End of life (EOL) | No official upstream patch |
A substantial portion of the global web continues to run legacy PHP 7.x, 8.0, and 8.1 environments. Because the PHP project does not backport fixes to unsupported branches, these systems will remain permanently exposed unless migrated to an actively maintained release.
Patch priorities and immediate mitigation steps
Cybersecurity agencies, including the US Cybersecurity and Infrastructure Security Agency (CISA), have urged administrators to patch all internet-exposed PHP servers immediately. Teams managing PHP infrastructure should take three immediate steps:
- Update runtime packages: Upgrade OS packages or container base images to the latest patched releases (8.5.12, 8.4.27, 8.3.36, or 8.2.35).
- Isolate and upgrade EOL environments: Organizations running PHP 8.1 or older must plan immediate runtime upgrades. While migrations are underway, place strict web application firewall (WAF) filters on file uploads and oversized multipart payloads to reduce exposure.
- Restrict worker process recycling: As an interim safeguard on PHP-FPM, set
pm.max_requeststo 1 or a very low threshold. Forcing workers to restart after each request eliminates stale global state retention across requests (mitigating CVE-2026-109619), though this introduces a noticeable performance overhead.
What to watch next
This disclosure confirms that frontier AI has shifted from theoretical benchmarking to actively redefining infrastructure security. Automated reasoning systems can now uncover intricate C memory flaws that evaded decades of human inspection, compressing vulnerability lifecycles into coordinated global patch campaigns.
However, the same capabilities will inevitably be leveraged by threat actors to hunt for zero-days at scale. Whether open-source maintainers and infrastructure operators can sustain this defensive patching tempo will be a critical test for modern software ecosystems.
Sources
Source: thephp.foundation