PHP, a language used to run websites and web applications, released fixes on October 21 for two critical flaws that can let an unauthenticated attacker execute code on a web server. Operators should update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, according to the project's security advisory.
PHP identifies web-serving installations including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk. It considers mod_php the highest-risk configuration, with an attack demonstrated before application code runs.
The Fix Depends on the Running Installation
Distributions and long-term-support vendors received patches in advance; consult their package advisories. PHP 8.1 and older are unsupported upstream. Exceptional minimal source backports for 7.4, 8.0 and 8.1 do not restore normal support.
The advisory identifies CVE-2026-109618 and CVE-2026-109619. Configuration changes can reduce particular attack paths, but PHP says an update is the only complete solution. The fix must reach the runtime serving web requests.
AI Discovery, Maintainer-Led Repairs
OpenAI says Calif found one critical flaw using GPT-5.6 Sol through Patch the Planet, while Wiz independently found and reported both vulnerabilities. PHP maintainers led the fixes and releases; OpenAI describes two months of coordination with researchers and infrastructure providers preparing protections before disclosure.
The company also proposes a wider response process covering validation, advance preparation, government coordination, downstream updates and deployment guidance. It leaves maintainers in charge of whom to involve. That is a proposed framework, not a newly binding industry standard.
OpenAI has published PHP version-checking Skills for operators. They provide inventory clues rather than independent proof that a security fix is installed: response headers can hide versions, distribution backports can retain older numbers, and the command-line PHP can differ from the web-serving build. An unknown result is not a clean bill of health.