PHP’s critical security release shows the work between finding a bug and protecting sites

The PHP project issued fixes for two remote-code-execution vulnerabilities; the research account describes a human-led investigation with AI assistance.

The PHP project released security updates on October 21 for two critical vulnerabilities that can allow unauthenticated remote code execution. Its advisory directs users to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, with distribution and long-term-support vendors providing their own package paths.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involve interrupted memory handling and stale internal state. The project says installations serving web requests are affected and identifies the highest demonstrated risk in Apache’s mod_php environment.

Human research and AI assistance

Calif Research’s discovery account describes investigators revisiting older PHP behaviour, working with OpenAI and Wiz and using an AI companion in source analysis. That is a more precise description than treating the discovery as an autonomous model acting alone.

The case illustrates a useful role for AI in a research process: helping examine code and connect observations while people choose questions, establish impact and coordinate disclosure. A tool’s contribution and ownership of the investigation are distinct.

The release is only one stage

Finding a serious defect does not immediately protect every application using the affected runtime. Maintainers must produce fixes, package vendors must distribute them and operators must identify their actual installations.

The PHP team also published follow-up notices, including an October 23 session-upload-progress advisory and updated Windows packages on October 26 for a separate dependency issue. These are different changes, so an operator needs the relevant vendor guidance rather than assuming every October update is interchangeable.

The news is the combination of a concrete security release and an increasingly capable research workflow. It does not establish that any particular website was compromised, or that publishing a fix means every affected deployment has installed it.

Sources

- [PHP October2026 security advisories](https://www.php.net/archive/2026.php) — PHP project - [PHP2Shell research and discovery account](https://calif.io/php2shell/) — Calif Research