The U.S. National Security Agency had a short message on Wednesday for anyone running PHP: patch, or take the server offline. The agency was not hedging. The two flaws it described, present in every release of the language since 2004, give an unauthenticated attacker a path to the file system and the database of a web server.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and carry severity scores of 9.2 out of 10. The first allows memory corruption when a request hits PHP’s memory limit at the wrong moment, leaving partially initialized internal data that the engine later treats as valid. On Apache servers running PHP as a module, an unauthenticated request can trigger it before any application code executes. The second leaves internal state pointing at memory from a previous request after a fatal error, so a later request handled by the same worker can read or use memory it should not see.
That second bug is the one that should worry operators of payment systems and login pages. Freed memory in a shared worker can hold passwords, session tokens, API keys and certificates from other users’ requests. Reading it does not require breaking the application on top of PHP, because the flaw sits in the engine underneath.
PHP released fixes on Wednesday at 13:30 UTC in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The patch covers PHP 8.2 and newer. Anything older, which includes a long tail of servers still running unsupported releases, needs a backport from a distribution or long-term-support vendor, or an upgrade. The PHP team published temporary mitigations for operators who cannot move immediately; the NSA, Britain’s National Cyber Security Centre and the European Union’s CERT-EU all said that isolation or shutdown is preferable to running unpatched.
The disclosure was not a surprise to everyone. Wiz Research found the flaws on Aug. 19 using its Atlas platform together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and the security firm Calif found them independently with GPT-5.6 Sol under an OpenAI program called Patch the Planet. Both worked with the PHP project through a coordinated disclosure that gave infrastructure providers time to prepare. Cloudflare, Fastly, Akamai, Amazon Web Services, Microsoft, Google and Vercel had protections or guidance ready before the patch went public.
Finland’s state IT provider Valtori took government services offline as a precaution. The Dutch national cyber security center pulled its own site, and the Port of Rotterdam, the Overheid.nl portal, the national football association and several hospitals followed. France’s Interior Ministry put its sites into maintenance. Wikipedia’s operator took down systems until they could be patched, and pages at the BBC, Edinburgh Council and DeviantArt went dark.
The uncomfortable part of the story is the timeline before the discovery. The PHP Foundation said a core developer first saw signs of the memory-limit problem in 2024, while fixing an unrelated issue found in the project’s first external security audit in years, funded through the Sovereign Tech Agency and run by Quarkslab. A potential exploit was theorized that year, but no concrete path was found, and the security team could not agree on a fix.
Every option carried a cost: breaking backward compatibility, introducing a new way to exhaust memory, or requiring changes to third-party extensions that could not be coordinated. The team works by consensus, the foundation wrote, and it stalled and restarted for months. “We won’t pretend otherwise: the delay was a structural failure,” the foundation said, attributing it to both its decision process and its lack of resources.
Analysts said the episode exposes a mismatch that AI is about to make worse. Finding bugs is getting cheaper and faster; fixing them still depends on a handful of people who understand a twenty-year-old engine and can absorb the compatibility risk of changing it. “The models compressed the research phase from years to weeks,” said one security analyst who reviewed the disclosure. “They did nothing for the maintainer who has to ship a patch without breaking forty million sites.”
OpenAI used the moment to argue for a new process. The company proposed a phased vulnerability response framework: early notice to affected institutions, coordination with governments, published remediation guidance, and a defender’s window between discovery and public disclosure. It also committed $1 billion in subsidized access to its Daybreak security tools over six months, aimed at organizations protecting essential services with limited security budgets.
Google Cloud, whose researchers were involved, told customers that PHP applications on its platform still faced unauthenticated remote code execution and memory disclosure until they upgraded, and urged movement to 8.2 or later. The U.S. Cybersecurity and Infrastructure Security Agency urged immediate patching and pointed to the same two identifiers.
For the security industry, the discovery changes an assumption. The flaws had been in the code for two decades and were considered impractical to exploit because the chain of steps required was at the edge of what a human researcher could do. Wiz said its team developed working exploits across multiple applications in hours once the models were pointed at the problem, adapting to each target’s memory layout. Complexity, long treated as a form of protection, no longer prices out the attacker.
The corollary is that defenders now have the same tools, and the constraint has moved to the unglamorous side of the ledger: maintainers, audits and money for projects that most of the web depends on and few companies pay for.
PHP still runs roughly 70% of the websites whose server-side language can be identified, according to W3Techs, including the software behind WordPress, Drupal, Joomla and Wikipedia. A flaw in the engine reaches all of it at once.
If a machine can find in a week what a generation of researchers missed, who pays for the fix that has to land before the exploit does?
