Two hidden flaws in the code running most of the internet just forced an emergency global fix.
On October 21, 2026, CVE.org assigned two critical bugs, CVE-2026-109618 and CVE-2026-109619, to flaws found deep inside the PHP programming language. The PHP security vulnerabilities October 2026 incident set off emergency patches and warnings from cyber agencies around the world, including India's CERT-In.
AI Ransomware Attacks Now Hit 84% of Victims, New Report Reveals Shocking Trend
How the PHP security vulnerabilities October 2026 came to light
Researchers at a cybersecurity firm called Calif found the first flaw on August 11, 2026, while working alongside OpenAI on code research. Wiz Research found the second flaw on August 24. Both teams reportedly used AI tools, including Google Gemini and ChatGPT, to comb through PHP's massive codebase and spot weaknesses that human reviewers might have missed for years.
The two bugs both trace back to how PHP handles fatal errors, especially moments when a server runs out of memory. CVE-2026-109618 happens when PHP cuts off a request during an out-of-memory crash, leaving behind data that is only partly set up. When the system tries to clean that mess up, it can mistake broken data for real data, opening the door to memory corruption. CVE-2026-109619 is similar but sneakier. It lets old data from a finished request stick around after its memory should have been cleared, so a completely different request handled by the same worker could stumble onto it.
Because PHP sits underneath huge chunks of the internet, including sites built on WordPress and Drupal, this was never just one company's problem. Reports estimated PHP powers more than 70% of all websites, though the exact number shifts depending on how it's counted. That scale is exactly why the PHP security vulnerabilities October 2026 disclosure triggered such a fast and widespread reaction.
PwC Cybersecurity Budget Survey: 84% Expect Spending To Jump as AI Risks Grow
Government warnings and the emergency patch rollout
CERT-In issued a critical-severity advisory on October 21, warning Indian organizations that attackers could remotely run malicious code on vulnerable systems without needing a password or login first. That warning mirrored alerts from other national cyber-response teams, all pointing to the same core message: patch now, because exploitation does not require authentication.
PHP's maintainers responded by pushing out emergency fixes ahead of their usual release schedule. Google Cloud published its own advisory the same day, describing the issue as vulnerabilities in "the core PHP language runtime" that could expose applications to "unauthenticated remote code execution and memory disclosure." Google said its own cloud infrastructure was not vulnerable, but it was careful to note that customers running their own PHP applications on top of that infrastructure could still be at risk.
Wiz, one of the firms credited with finding the flaws, urged administrators toward immediate patching and called the bugs among the "most severe vulnerabilities ever discovered" through AI-assisted research. That framing reflects Wiz's own assessment of how the flaws were found and what they could do, rather than some official global ranking system. Severity scores varied across sources too, with some media reports citing 9.2 out of 10 while Wiz's own vulnerability database listed both entries at 8.1.
Why this PHP flaw worried security experts so much
What made this different from a typical software bug is where it lived. Most security problems show up inside a specific app, like a vulnerable WordPress plugin or a flawed shopping cart script. This one sat inside PHP itself, the engine running underneath those apps. That means a website could be at risk even if its own code was written perfectly, simply because of the PHP version processing it behind the scenes.
Speaking to Al Jazeera, one expert explained that the flaw could let a hacker run code on a website, change its content, or force it to leak personal information stored in a connected database. Since PHP has been used to build websites since the early 2000s, plenty of servers out there are still running older versions, some of which are no longer officially supported. Google's own advisory flagged vulnerable versions stretching all the way up through PHP 8.5.11, touching both current and long-retired branches.
The involvement of AI tools in discovering these flaws also became part of the story itself. Researchers used large language models to dig through PHP's sprawling, decades-old codebase looking for exactly these kinds of subtle memory-handling mistakes. It's a preview of how future vulnerabilities, good and bad, might increasingly be found by machines instead of humans combing through code line by line.
What website owners and businesses need to do next
For now, the priority for any organization running PHP is straightforward: figure out exactly which version is in use and apply the fixed release PHP's maintainers put out. That's not always simple. Businesses running outdated or unsupported PHP branches may need a full upgrade rather than a quick patch, which takes more time and testing.
Security teams are also being told to check server logs for strange requests, review long-running PHP processes, and look closely at hosting panels, containers, and content management systems like WordPress and Drupal that commonly sit on top of PHP. Because one of the bugs involves data leaking between separate requests, investigators are being told to look beyond simple website defacement and check whether passwords or database records might have been exposed too.
As of the latest reporting, there was no confirmed sign that either flaw had been added to the United States' official Known Exploited Vulnerabilities list, and Wiz's own database marked both entries as having fixes available but not yet confirmed as actively exploited. Still, with fixes only just released and so many servers still unpatched, security researchers expect more details, detection tools, and possibly real-world attack reports to surface in the coming weeks.
