Global IT operations teams scrambled to secure web infrastructure after a pair of severe remote code execution vulnerabilities affecting PHP were disclosed. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws carry a severity score of 9.2 and allow unauthenticated attackers under specific conditions to acquire server execution privileges before business code even runs.
Underlying critical infrastructure across the internet depends heavily on PHP, powering widespread content management platforms including WordPress, Drupal, and Magento. Despite decades of code audits and security reviews by developers and researchers, the vulnerabilities remained hidden for 14 years.
The discovery was propelled by artificial intelligence. OpenAI confirmed that security firm Calif utilized GPT-5.6 Sol to identify the critical flaws. Additionally, Wiz Research independently discovered and reported related issues using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Under the direction of researchers, the AI models reviewed the underlying codebase of PHP, identifying an anomalous pathway where data was written only partially but treated as complete. Using this insight to establish reusable audit rules, the tools uncovered a second underlying issue.
The disclosure process quickly deteriorated into chaos due to multiple missteps. An anonymous online post initially leaked the vulnerability’s CVE designation, which PHP officials subsequently confirmed. Security firm Calif then accidentally published an attack demonstration video; although the video was quickly deleted, copies spread rapidly across the web. Finally, software supply chain security firm Chainguard prematurely published a build image containing a fix, effectively delivering the exact vulnerability locations directly to potential attackers before official patches were properly deployed.
OpenAI has warned that the newly exposed vulnerabilities represent only a fraction of broader systemic risks. Furthermore, the PHP Foundation noted that PHP versions 8.1 and earlier will not receive official updates, leaving administrators dependent on source code patches or distribution backports.
The PHP Foundation revealed that the trail for CVE-2026-109618 originated during an external security audit of the PHP project in 2024. At that time, a core developer addressing audit findings had already noted the underlying risks. According to the foundation, the failure to address the issue earlier stemmed from structural challenges, describing the delay as a structural failure.
Developers frequently find that identifying a vulnerability is simpler than resolving it safely. Proposed fixes carried significant costs, including potential compromises to backward compatibility, the introduction of new denial-of-service risks, and the complex coordination required across numerous third-party extensions. Consequently, remediation efforts repeatedly stalled and were shelved.
This incident has intensified long-standing concerns regarding the sustainability of open-source maintenance. Global commercial enterprises and startups rely heavily on foundational open-source software like PHP, while the actual maintenance burden rests on a small group of volunteers operating with constrained financial resources. In September, PHP joined forces with Java, Python, Rust, and Eclipse foundations alongside OpenSSF to issue a joint statement declaring that open-source infrastructure is not free and urging commercial beneficiaries to invest properly in underlying systems.
While artificial intelligence dramatically accelerates the discovery of security flaws, the labor-intensive realities of patching, asset inventory, version compatibility, testing, and deployment remain trapped within organizational and operational bottlenecks.
