> ## Content Index > Fetch the complete content index at: https://www.implicator.ai/llms.txt > Use this file to discover other available public pages before exploring further. # PHP Fixes a Memory Bug Flagged in 2024 After AI Turned It Into a Working Exploit - URL: https://www.implicator.ai/php-patches-ai-found-memory-flaws/ - Published: 2026-10-22T04:36:47.000Z - Updated: 2026-10-22T04:36:47.000Z - Description: Two critical flaws in PHP, which runs on 69.3% of websites with a known server-side language, got emergency patches on Oct. 21. An AI-assisted audit turned a weakness the project spotted in 2024 into a working attack. Then the embargo broke. - Author: Marcus Schuler - Tags: AI News On Aug. 11, 2026, Thai Duong, chief executive of the security firm Calif, called Volker Dusch, the PHP Foundation’s AI Security Engineer in Residence. A researcher had found a way to take over servers running PHP. “Oh God, what are we doing now?” Dusch [recalled thinking](https://www.wsj.com/tech/cybersecurity/ai-just-found-a-bug-that-puts-up-to-70-of-the-worlds-websites-at-risk-fd0902ea?ref=implicator.ai). “And then you calm down, you let the adrenaline flow through, and you get to fixing,” he said. The root cause was already known. Calif’s Aug. 11 remote code execution report had the same root cause as the out-of-memory problem a PHP core developer had [first identified in 2024](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/?ref=implicator.ai) while fixing a Quarkslab audit issue. The problem remained unfixed. The [Oct. 21, 2026, security release](https://www.php.net/archive/2026.php?ref=implicator.ai#2026-10-21-5) patched two critical flaws in PHP itself after AI-assisted research turned a long-known weak spot into working remote code execution. W3Techs’ Oct. 22 figures put PHP on 69.3% of websites with an identifiable server-side language. The Breakdown - PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct. 21, 2026, fixing two flaws rated CVSS 9.2 that can allow unauthenticated remote code execution. - Calif's Aug. 11 report shared a root cause with an out-of-memory problem a PHP core developer first identified in 2024; the PHP Foundation called the delay a structural failure. - A leak on Oct. 20 pushed the release forward a day, and government, hospital and other sites across Europe went offline as a precaution. - W3Techs puts PHP on 69.3% of websites with an identifiable server-side language; 26.9% of PHP sites run version 7 and 7.7% version 5. AI-generated summary, reviewed by an editor. [More on our AI guidelines](https://www.implicator.ai/about/). ## A weak spot found and shelved Germany’s Sovereign Tech Agency funded the 2024 audit. While addressing its findings, developers considered how running out of memory could leave PHP in an unsafe state. They theorized an exploit but found no concrete route to one. Other problems with demonstrated consequences took priority. Some approaches would break compatibility with existing software. Others risked letting attackers interrupt services or required changes across third-party extensions. The security team worked by consensus, and the few developers who understood the engine deeply had other responsibilities. Work stalled and restarted repeatedly over months. The PHP Foundation said the delay “was a structural failure, caused by both the security team's decision process and its lack of resources.” The team has begun changing its procedures to allow majority decisions and accept compromises. The foundation said serious vulnerabilities with fixes stuck on hard trade-offs would now reach its leadership much sooner, so it can help steer a timely resolution. Once the August reports established the impact, foundation-funded staff worked full time on the repair, eventually through weekends and around the clock. The eventual repair touched close to 200 files, with developers writing more than 10,000 lines of code. Calif’s 2026 work drew on earlier research. A report filed in 2020, bug #78876, described an out-of-memory problem and temporary files left behind. Security researcher Stefan Esser had found PHP’s first memory-limit remote vulnerability in 2004\. Calif says it began with questions about Esser’s findings; Esser connected Calif with Dusch. ## What the models changed Calif began its OpenAI-funded audit on July 30\. Ryan Austin, the researcher credited as “Ryan A” by the PHP Foundation, used an OpenAI model to investigate the code. Within days, Austin used the model to find a way to force an out-of-memory failure on demand and identify interruptions leaving half-built internal data in the interpreter. That let Calif build a working WordPress attack. Austin found how to control code running in memory with as few as a few dozen requests. On smaller systems, the hack takes seconds; on complex ones, hours. He reported working remote code execution on Aug. 11\. OpenAI independently reported the same root cause that day. Wiz discovered its first flaw on Aug. 19 and reported its findings on Aug. 24\. OpenAI supplied further attack paths on Sept. 18. FREE · ABOUT FIVE MINUTES Track the AI-found bugs before attackers do. Implicator cuts the flood to the developments worth your attention, with concise reporting on what changed and why it matters. Delivered every weekday at 4:45 a.m. Pacific, 7:45 a.m. Eastern. Email address Get the free briefing Check your inbox for the confirmation link. From San Francisco. No spam. Unsubscribe anytime. Remote code execution means an attacker can make a server run software of the attacker’s choosing from elsewhere, potentially without logging in. These flaws sit in PHP itself. Patching a WordPress plugin or correcting a website’s own code does not fix them. Administrators must update the PHP runtime that executes their applications. One flaw involves PHP treating unfinished internal data as valid after memory runs out. The other leaves references to memory that has already been freed, which a later request can use. The PHP project’s advisory says risk is highest on Apache’s mod\_php setup, where an unauthenticated request can trigger an attack before application code runs. Wiz [demonstrated takeovers](https://www.wiz.io/blog/php2shell-php-rce?ref=implicator.ai) of WordPress, Drupal and Joomla deployments without authentication. Calif confirmed unauthenticated remote code execution in its own tests against additional applications, including MediaWiki and Nextcloud. At least one flaw reaches back to PHP 5.4. The demonstrations did not make every deployment equally easy to attack. Differences in PHP versions and application behavior required repeated testing and debugging, with some attack paths needing substantial adaptation for each target. Ami Luttwak, Wiz’s co-founder, called it “the most severe AI vulnerability that was ever found.” Wiz claims one researcher completed in a week work that previously would have taken a world-class team months. Wiz cited no independent benchmark for the comparison. Both Wiz and OpenAI, which funded Calif’s audit, sell security tools. ## The disclosure breaks The planned release date was Oct. 22\. Around 15:00 UTC on Oct. 20, the vulnerability identifiers circulated online with an incorrect severity score of 10.0\. The initial leak contained no technical details. Both flaws, CVE-2026-109618 and CVE-2026-109619, carry CVSS v4.0 scores of 9.2. PHP published its advance warning that evening and moved the coordinated release to Oct. 21 at 14:00 UTC. Distributors were still packaging updates. Immediate publication would have left many administrators without an easy installation path, the foundation said. The PHP Foundation said Calif then mistakenly published a proof-of-concept video. It deleted the video, but copies circulated. At 07:41 UTC on Oct. 21, more than six hours before the coordinated release, Chainguard published built images containing the fix. The PHP Foundation said that broke the embargo and let attackers examine the repair while other users waited. A Hacker News commenter criticized the advance warning: “it's an invitation for everyone to put their agents to work.” Dusch described the accelerated schedule as “a good balance to inform defenders” and “not give attackers too much time to develop exploits.” ## Europe takes sites offline Belgium’s foreign ministry took its sites offline citing reports of attacks. The country’s cybersecurity centre said it had recorded no attacks on Belgian websites. Know someone who'd find this useful? [✉️ Email it to a friend in one click](mailto:?subject=A%20newsletter%20I%20think%20you%27d%20like&body=This%20is%20one%20of%20maybe%20three%20newsletters%20I%20actually%20read.%20The%20rest%20just%20pile%20up%2C%20unread%2C%20judging%20me.%0A%0AAnd%20yes%2C%20this%20email%20mostly%20wrote%20itself%2C%20which%20is%20a%20little%20on%20the%20nose%20for%20an%20AI%20newsletter.%20Doesn%27t%20make%20it%20wrong.%20implicator.ai%20is%20good.%0A%0ASubscribe%20free%3A%20https%3A%2F%2Fwww.implicator.ai%2Fsubscribe%2F%3Futm%5Fsource%3Dnewsletter%26utm%5Fmedium%3Dforward%26utm%5Fcampaign%3Demail%5Fforward), or they can [subscribe free here](https://www.implicator.ai/subscribe/?utm%5Fsource=newsletter&utm%5Fmedium=forward&utm%5Fcampaign=forward%5Fto%5Fcolleague). On Oct. 21, Germany’s federal IT provider ITZBund took several websites offline as a precaution. France’s Interior Ministry shut prefecture websites while awaiting a fix. In the Netherlands, affected services included the Port of Rotterdam, Overheid.nl and numerous hospital websites. Finland’s Valtori shut government web services. The Wikimedia Foundation also took down some systems pending patches. Calif’s tests had confirmed code execution against MediaWiki, the software behind Wikipedia. The accounts of exploitation differed. The PHP Foundation said it had found no functional exploits among the circulating examples at release. CERT-EU said initial proofs of concept were circulating, increasing the likelihood of exploitation. Cloudflare said it [observed attack traffic](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/?ref=implicator.ai) targeting customers after the leak and deployed firewall protections about nine hours before disclosure. No published count establishes how many servers were compromised. PHP’s roughly 70% share measures language use among identifiable websites, rather than the proportion vulnerable or successfully attacked. The extent of real-world compromise remains unknown. CERT-EU advised isolating internet-facing applications that could not be patched. ## Who pays for the fix The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. Updating is the only complete fix, the PHP project says; firewall protections reduce exposure without replacing it. In W3Techs’ Oct. 22 figures, 65.3% of PHP websites used version 8, 26.9% used version 7 and 7.7% used version 5\. Roughly a third therefore ran branches without official project updates, before counting unsupported releases within version 8\. Some distributions and long-term-support vendors supply backported fixes. The PHP team also published minimal source backports for versions 7.4, 8.0 and 8.1, without issuing releases. PHP 8.2 reaches end of life on Dec. 31, 2026. Alexandre Daubois joined the PHP Foundation in July to triage and fix security reports. A separate foundation security team, established in May, works alongside the PHP security team on report handling and hardening. Since July 1, the security team has published 15 CVEs and processed more than 100 invalid, duplicate or unreproducible reports. The foundation says AI helps validate reports and group those sharing a root cause, but a person makes every call and works on every patch. The foundation is asking companies, hosting providers and governments to fund more engineers with deep knowledge of PHP. OpenAI says it has [committed $1 billion in subsidized access to Daybreak](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities?ref=implicator.ai), its cybersecurity offering, for organizations with limited security resources protecting essential services. Duong described what could follow publication of the fixes. “Some dude on Twitter could take the patches and run AI against it and post some exploit script,” he said. “All hell will break loose.” PHP at a glance Rasmus Lerdorf created PHP in 1994 to track visits to his online resume. He called it “Personal Home Page Tools” and released its source code in June 1995\. Andi Gutmans and Zeev Suraski, working in Tel Aviv, rewrote the parser for PHP 3.0, released in June 1998\. The name became the recursive acronym “PHP: Hypertext Preprocessor.” Their Zend Engine powered PHP 4.0 in May 2000. PHP 7.0, released in 2015, ran up to twice as fast as PHP 5.6\. PHP 8.0 added a just-in-time compiler in 2020\. The language powers WordPress, Drupal and Joomla, along with Wikipedia’s MediaWiki software. W3Techs’ figures dated Oct. 22, 2026, put it on 69.3% of websites with an identifiable server-side language. The PHP Foundation formed in November 2021 as core contributor Nikita Popov prepared to spend less time on PHP, bringing funding to work that depended heavily on a small number of developers. Frequently Asked Questions What are the php2shell vulnerabilities? Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2\. One involves PHP treating unfinished internal data as valid after memory runs out. The other leaves references to freed memory that a later request can use. Both can allow unauthenticated remote code execution. Which PHP versions fix the flaws? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\. The PHP project says updating is the only complete fix. PHP 8.1 and older get no releases, though the security team published minimal source backports for 7.4, 8.0 and 8.1, and some distributions and long-term-support vendors backport fixes. Does updating WordPress or a plugin fix the problem? No. The flaws sit in the PHP runtime, not in application code, so administrators must update PHP itself. Wiz demonstrated unauthenticated takeovers of WordPress, Drupal and Joomla deployments, and Calif confirmed remote code execution in its own tests against applications including MediaWiki and Nextcloud. How did AI figure in the discovery? Calif researcher Ryan Austin used an OpenAI model during an OpenAI-funded audit that began July 30, and within days found a way to force out-of-memory failures on demand and build a working WordPress attack. Wiz also used AI models. Wiz cited no independent benchmark for its claim that AI cut months of work to a week. Were the flaws exploited before the patch? Accounts differ. The PHP Foundation said it found no functional exploits among circulating examples at release. CERT-EU said initial proofs of concept were circulating, and Cloudflare said it observed attack traffic after the leak. No published count establishes how many servers were compromised. AI-generated summary, reviewed by an editor. [More on our AI guidelines](https://www.implicator.ai/about/). [Anthropic Offers Open-Source Projects Free Mythos Bug Scans With No Human ReviewAnthropic launched OSS Scanner on Oct. 8, a free opt-in service that sends model-generated vulnerability reports to eligible open-source projects without human review. Its models flagged 29,439 candidThe Implicator![](https://www.implicator.ai/content/images/2026/10/20261009-071930-oss_scanner_maintainer.webp)](https://www.implicator.ai/anthropic-oss-scanner-free-unreviewed-bug-reports/) [Nvidia Says Its New Agent Safety Platform Could Have Stopped the Hugging Face BreachNvidia launched its Open Agent Safety Platform on Monday and said it could have stopped OpenAI’s agents from breaching Hugging Face in July. The system pairs an open-source runtime that limits agent aThe Implicator![](https://www.implicator.ai/content/images/2026/09/nvidia-agent-safety-platform.webp)](https://www.implicator.ai/nvidia-agent-safety-platform-hugging-face-claim/) [OpenAI Agents Attacked RubyGems and Tried to Steal User API KeysOpenAI confirmed Friday that its agents used RubyGems during a May attack reconstructed from packages the attackers left in public. The agents submitted more than 2,000 packages on May 11 and 12, turnThe Implicator![](https://www.implicator.ai/content/images/2026/09/20260912-033701-rubygems-flood-v2.webp)](https://www.implicator.ai/openai-agents-attacked-rubygems-and-tried-to-steal-user-api-keys/)