PHP Fixes a Memory Bug Flagged in 2024 After AI Turned It Into a Working Exploit

On Aug. 11, 2026, Thai Duong, chief executive of the security firm Calif, called Volker Dusch, the PHP Foundation’s AI Security Engineer in Residence. A researcher had found a way to take over servers running PHP. “Oh God, what are we doing now?” Dusch recalled thinking. “And then you calm down, you let the adrenaline flow through, and you get to fixing,” he said.

The root cause was already known. Calif’s Aug. 11 remote code execution report had the same root cause as the out-of-memory problem a PHP core developer had first identified in 2024 while fixing a Quarkslab audit issue. The problem remained unfixed.

The Oct. 21, 2026, security release patched two critical flaws in PHP itself after AI-assisted research turned a long-known weak spot into working remote code execution. W3Techs’ Oct. 22 figures put PHP on 69.3% of websites with an identifiable server-side language.

A weak spot found and shelved

Germany’s Sovereign Tech Agency funded the 2024 audit. While addressing its findings, developers considered how running out of memory could leave PHP in an unsafe state. They theorized an exploit but found no concrete route to one. Other problems with demonstrated consequences took priority.

Some approaches would break compatibility with existing software. Others risked letting attackers interrupt services or required changes across third-party extensions. The security team worked by consensus, and the few developers who understood the engine deeply had other responsibilities. Work stalled and restarted repeatedly over months.

The PHP Foundation said the delay “was a structural failure, caused by both the security team's decision process and its lack of resources.” The team has begun changing its procedures to allow majority decisions and accept compromises.

The foundation said serious vulnerabilities with fixes stuck on hard trade-offs would now reach its leadership much sooner, so it can help steer a timely resolution. Once the August reports established the impact, foundation-funded staff worked full time on the repair, eventually through weekends and around the clock. The eventual repair touched close to 200 files, with developers writing more than 10,000 lines of code.

Calif’s 2026 work drew on earlier research. A report filed in 2020, bug #78876, described an out-of-memory problem and temporary files left behind. Security researcher Stefan Esser had found PHP’s first memory-limit remote vulnerability in 2004. Calif says it began with questions about Esser’s findings; Esser connected Calif with Dusch.

What the models changed

Calif began its OpenAI-funded audit on July 30. Ryan Austin, the researcher credited as “Ryan A” by the PHP Foundation, used an OpenAI model to investigate the code. Within days, Austin used the model to find a way to force an out-of-memory failure on demand and identify interruptions leaving half-built internal data in the interpreter. That let Calif build a working WordPress attack. Austin found how to control code running in memory with as few as a few dozen requests. On smaller systems, the hack takes seconds; on complex ones, hours. He reported working remote code execution on Aug. 11. OpenAI independently reported the same root cause that day.

Wiz discovered its first flaw on Aug. 19 and reported its findings on Aug. 24. OpenAI supplied further attack paths on Sept. 18.

Remote code execution means an attacker can make a server run software of the attacker’s choosing from elsewhere, potentially without logging in. These flaws sit in PHP itself. Patching a WordPress plugin or correcting a website’s own code does not fix them. Administrators must update the PHP runtime that executes their applications.

One flaw involves PHP treating unfinished internal data as valid after memory runs out. The other leaves references to memory that has already been freed, which a later request can use. The PHP project’s advisory says risk is highest on Apache’s mod_php setup, where an unauthenticated request can trigger an attack before application code runs.

Wiz demonstrated takeovers of WordPress, Drupal and Joomla deployments without authentication. Calif confirmed unauthenticated remote code execution in its own tests against additional applications, including MediaWiki and Nextcloud. At least one flaw reaches back to PHP 5.4.

The demonstrations did not make every deployment equally easy to attack. Differences in PHP versions and application behavior required repeated testing and debugging, with some attack paths needing substantial adaptation for each target.

Ami Luttwak, Wiz’s co-founder, called it “the most severe AI vulnerability that was ever found.” Wiz claims one researcher completed in a week work that previously would have taken a world-class team months. Wiz cited no independent benchmark for the comparison. Both Wiz and OpenAI, which funded Calif’s audit, sell security tools.

The disclosure breaks

The planned release date was Oct. 22. Around 15:00 UTC on Oct. 20, the vulnerability identifiers circulated online with an incorrect severity score of 10.0. The initial leak contained no technical details. Both flaws, CVE-2026-109618 and CVE-2026-109619, carry CVSS v4.0 scores of 9.2.

PHP published its advance warning that evening and moved the coordinated release to Oct. 21 at 14:00 UTC. Distributors were still packaging updates. Immediate publication would have left many administrators without an easy installation path, the foundation said.

The PHP Foundation said Calif then mistakenly published a proof-of-concept video. It deleted the video, but copies circulated. At 07:41 UTC on Oct. 21, more than six hours before the coordinated release, Chainguard published built images containing the fix. The PHP Foundation said that broke the embargo and let attackers examine the repair while other users waited.

A Hacker News commenter criticized the advance warning: “it's an invitation for everyone to put their agents to work.” Dusch described the accelerated schedule as “a good balance to inform defenders” and “not give attackers too much time to develop exploits.”

Europe takes sites offline

Belgium’s foreign ministry took its sites offline citing reports of attacks. The country’s cybersecurity centre said it had recorded no attacks on Belgian websites.

On Oct. 21, Germany’s federal IT provider ITZBund took several websites offline as a precaution. France’s Interior Ministry shut prefecture websites while awaiting a fix. In the Netherlands, affected services included the Port of Rotterdam, Overheid.nl and numerous hospital websites. Finland’s Valtori shut government web services.

The Wikimedia Foundation also took down some systems pending patches. Calif’s tests had confirmed code execution against MediaWiki, the software behind Wikipedia.

The accounts of exploitation differed. The PHP Foundation said it had found no functional exploits among the circulating examples at release. CERT-EU said initial proofs of concept were circulating, increasing the likelihood of exploitation. Cloudflare said it observed attack traffic targeting customers after the leak and deployed firewall protections about nine hours before disclosure.

No published count establishes how many servers were compromised. PHP’s roughly 70% share measures language use among identifiable websites, rather than the proportion vulnerable or successfully attacked. The extent of real-world compromise remains unknown. CERT-EU advised isolating internet-facing applications that could not be patched.

Who pays for the fix

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating is the only complete fix, the PHP project says; firewall protections reduce exposure without replacing it.

In W3Techs’ Oct. 22 figures, 65.3% of PHP websites used version 8, 26.9% used version 7 and 7.7% used version 5. Roughly a third therefore ran branches without official project updates, before counting unsupported releases within version 8. Some distributions and long-term-support vendors supply backported fixes. The PHP team also published minimal source backports for versions 7.4, 8.0 and 8.1, without issuing releases. PHP 8.2 reaches end of life on Dec. 31, 2026.

Alexandre Daubois joined the PHP Foundation in July to triage and fix security reports. A separate foundation security team, established in May, works alongside the PHP security team on report handling and hardening. Since July 1, the security team has published 15 CVEs and processed more than 100 invalid, duplicate or unreproducible reports. The foundation says AI helps validate reports and group those sharing a root cause, but a person makes every call and works on every patch.

The foundation is asking companies, hosting providers and governments to fund more engineers with deep knowledge of PHP. OpenAI says it has committed $1 billion in subsidized access to Daybreak, its cybersecurity offering, for organizations with limited security resources protecting essential services.

Duong described what could follow publication of the fixes. “Some dude on Twitter could take the patches and run AI against it and post some exploit script,” he said. “All hell will break loose.”

Anthropic Offers Open-Source Projects Free Mythos Bug Scans With No Human Review

Anthropic launched OSS Scanner on Oct. 8, a free opt-in service that sends model-generated vulnerability reports to eligible open-source projects without human review. Its models flagged 29,439 candid

The Implicator

Nvidia Says Its New Agent Safety Platform Could Have Stopped the Hugging Face Breach

Nvidia launched its Open Agent Safety Platform on Monday and said it could have stopped OpenAI’s agents from breaching Hugging Face in July. The system pairs an open-source runtime that limits agent a

The Implicator

OpenAI Agents Attacked RubyGems and Tried to Steal User API Keys

OpenAI confirmed Friday that its agents used RubyGems during a May attack reconstructed from packages the attackers left in public. The agents submitted more than 2,000 packages on May 11 and 12, turn

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai