‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire. Two decades-old flaws in PHP, the scripting language powering 70% of the world’s websites, have been exposed, risking remote code execution and memory disclosure across global server infrastructure.
The PHP Backbone and Its Origins
PHP, created by Rasmus Lerdorf in 1993 and released in 1995, began as a set of Common Gateway Interface (CGI) programs in C for maintaining personal homepages. It evolved into a general-purpose scripting language geared towards web development, with its name now standing for PHP: Hypertext Preprocessor. The language grew organically, without a formal specification, leading to inconsistencies in function naming and syntax. Despite this, PHP became the backbone for major platforms like WordPress, Joomla, Drupal, and Wikipedia’s MediaWiki, powering dynamic web content and backend logic for millions of sites.
The Mechanics of the Flaws
Wiz Research uncovered two critical memory-safety vulnerabilities in PHP’s core engine, grouped under CVE-2026-109618 and CVE-2026-109619, both rated with a severity of CVSS 9.2. CVE-2026-109618 occurs when out-of-memory handling interrupts PHP during partial initialization of internal request data, causing cleanup processes to treat invalid data as valid. CVE-2020-109619 arises when request-owned internal state persists after its memory has been freed, allowing subsequent requests to use stale data. These flaws can lead to unauthenticated remote code execution and memory disclosure, exposing sensitive information like passwords, tokens, and API keys.
AI Uncovers Decades-Old Vulnerabilities
The vulnerabilities, present in every PHP version released over the last decade, remained hidden due to the complexity of demonstrating their exploitability. Frontier AI models played a pivotal role in reducing this barrier, turning longstanding flaws into actionable exploits. According to Wiz Research, these findings rank among the most severe vulnerabilities in software history, challenging assumptions about the security of shared internet infrastructure. The discovery underscores the shift in how AI is transforming cybersecurity, making previously impractical exploits feasible.
Global Impact and Immediate Risks
With PHP powering 70% of the internet, these vulnerabilities pose a significant risk to global server infrastructure. Successful exploitation could allow attackers to take control of servers, steal sensitive data, and deface websites. The UK’s National Cyber Security Centre (NCSC) has urged organizations to immediately identify systems running PHP, apply vendor updates, or take vulnerable systems offline. The PHP Group released a security update on October 21, 2026, addressing these flaws, but the widespread use of PHP means remediation efforts will be extensive and urgent.
What Administrators Must Do Now
Server administrators must act swiftly to secure their networks. The NCSC recommends identifying all PHP installations, prioritizing internet-facing systems, and applying the latest updates. For those unable to update immediately, temporary mitigations are available, though taking systems offline may be necessary in extreme cases. The PHP Team has provided additional hardening steps, emphasizing the need for continuous monitoring of security updates from third-party vendors. As the internet grapples with these vulnerabilities, watch this space for how this event reshapes cybersecurity practices in the AI era.
Organic Growth and Architectural Legacy
The PHP language at first evolved without a written formal specification or standard, with the original implementation acting as the de facto standard that other implementations aimed to follow. This organic development approach, initiated by Rasmus Lerdorf, led to inconsistencies in function naming and syntax that persist today. Lerdorf himself noted in retrospect: “I don’t know how to stop it […] there was never any intent to write a programming language […] I just kept adding the next logical step on the way.”
These early architectural decisions, made over a decade ago, contributed to the memory-safety vulnerabilities discovered by Wiz Research. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
The standard PHP interpreter, powered by the Zend Engine, is free software released under the PHP License. PHP has been widely ported and can be deployed on most web servers on a variety of operating systems and platforms. The language’s widespread adoption and critical role in web infrastructure means that vulnerabilities in its core engine can affect websites across the ecosystem, even when their own application code is secure.
Detailed Exploitation Path of CVE‑2026‑109618 and CVE‑2026‑109619
The out‑of‑memory (OOM) condition described in CVE‑2026‑109618 can interrupt the PHP engine at the precise moment when internal request structures have only been half‑filled. Because the cleanup routine runs before the request data is fully validated, it may accept the partially‑initialized buffers as legitimate, allowing malformed data to be processed later in the request lifecycle. This premature acceptance creates a memory‑corruption window that attackers can trigger remotely, leading to unauthenticated code execution.
In the second flaw, CVE‑2026‑109619, the PHP worker retains a pointer to request‑owned state after the underlying memory block has been released. When a subsequent request reuses the same worker thread, the stale pointer is dereferenced before the normal initialization routine overwrites it. The result is a classic use‑after‑free scenario: the new request operates on leftover data from the previous one, potentially exposing passwords, tokens, or other sensitive material stored in process memory.
Both vulnerabilities share a common impact pathway: they corrupt the process’s memory layout, enabling an attacker to inject arbitrary instructions or read confidential memory regions. The NCSC advisory notes that exploiting either condition can lead to “unauthenticated remote code execution,” and the PHP security update released on October 21 2026 patches the OOM handling and the request‑state cleanup to eliminate these unsafe paths.
Sources
- PHP
- Critical security issue affecting PHP
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Photo: Tyler / Unsplash (Unsplash License)
