AI finds decade-old PHP flaws a WordPress update won't fix

Bugs that sat in PHP for more than ten years have just been found with help from AI, according to Wiz, a Google-owned security firm. They could let attackers take over a web server without logging in.

The PHP project released updates fixing both flaws on 21 October 2026: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The next day ThaiCERT, Thailand's national computer emergency response team, told organisations to install them quickly.

But updating WordPress plugins, themes or site code alone will not fix this, because the flaws sit in PHP itself, Cloudflare says. That means PHP on the server has to be updated, either by you or by your hosting provider.

PHP is the server-side language behind company websites and online shops built with WordPress, Joomla, Drupal or Magento. About 7 in 10 websites whose server-side language is known (69.3%) use PHP, W3Techs data for 22 October 2026 show.

Wiz says nearly every PHP version back to 5.4 is affected, and ThaiCERT says proof-of-concept (PoC) attack code is already public.

SV News sums up what to check, which version to update to, what to do on an older version, and where AI comes in.

Four steps fix it, from checking the version to looking for traces

ThaiCERT asks organisations to check every PHP system they run, in these steps.

1. Check the version: run php -v on the server or look up the version in your hosting control panel. Cover web and application servers, containers, hosting control panels and bundled products that contain PHP.
2. Update: PHP 8.5 to 8.5.12, PHP 8.4 to 8.4.27, PHP 8.3 to 8.3.36 and PHP 8.2 to 8.2.35, or later. Some packages from Linux distributions, hosts or control panels carry the patch but keep the old version number, so check your provider's notice too.
3. Restart: restart PHP-FPM, Apache or LiteSpeed, and rebuild container images from a patched base image.
4. Look for traces: check logs for out-of-memory or fatal errors, and look for files of unknown origin in web and upload folders.

ThaiCERT warns that a log with no errors does not prove a system is safe, because some attacks may happen before PHP records anything.

Cloudflare says customers using its web application firewall (WAF), on free or paid plans, have been protected automatically since 21 October. Pro, Business and Enterprise customers should still check that its Managed Ruleset is deployed in block mode.

The PHP project stresses that configuration changes close some attack paths but do not make a server safe. Only an update fixes the flaws completely.

If you cannot patch yet and cannot use the interim settings, ThaiCERT says to consider taking the system off the internet or allowing access only from approved networks and IP addresses until it is patched. The US National Security Agency (NSA) said sites that cannot be patched should go offline for now, TechCrunch reported.

More than a third of PHP sites run versions no longer updated

Every system that serves websites with PHP is at risk.

The PHP advisory covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the risk highest on mod_php, where a request from someone not logged in can start an attack before any website code runs.

Wiz says its team ran code without a login on WordPress, Drupal and Joomla installations built from their latest container images, and showed attackers could read server memory holding passwords, tokens and API keys.

W3Techs figures put 26.9% of PHP websites on version 7 and 7.7% on version 5. Among PHP 8 sites, 15.2% are still on 8.1 and 5.8% on 8.0. Together, more than a third of PHP sites run versions the PHP project no longer updates.

Sites on PHP 8.1 or older get no new release from the PHP project, only minimal source patches for 7.4, 8.0 and 8.1. The way out is to ask your Linux distribution or host for a backport, a fix copied back to an older version, or to move to a supported version.

Google Cloud says its platform is not vulnerable, but customers who build their own container images on Cloud Run or Google Kubernetes Engine must rebuild them with a patched PHP.

Wiz says AI let one researcher find old bugs in a week

Both flaws lie in how PHP handles memory.

The first happens when PHP cleans up after a request runs out of memory, the PHP Foundation explains. In the second, if a fatal error strikes at the wrong moment, PHP can keep pointing at freed memory from an earlier request, which the next request may then use.

Put simply, PHP can pick up memory it should have thrown away and use it again, and attackers can use that moment to run their own code on the server.

Wiz says the flawed code is more than ten years old. Its team used the Wiz Atlas agent, an AI that can carry out many steps in a row, together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

Wiz claims one researcher finished the work in a week, a job that once took a top team months.

OpenAI says security testing firm Calif found one flaw with GPT-5.6 Sol under OpenAI's Patch the Planet programme, and that Wiz found and reported both on its own.

OpenAI calls the case "one of the most impactful security issues in recent memory" and warns that the same capabilities can also help attackers build exploit code faster.

A PHP core developer saw the first signs of the out-of-memory problem behind CVE-2026-109618 in 2024, while fixing an issue from an external audit, but the security team could not settle on a fix and work stalled for months, the PHP Foundation says. It calls the delay "a structural failure".

A CVE leak forced PHP to release early

The CVE numbers, the ID tags given to the two flaws, leaked before the release date.

They began circulating online at about 22:00 Bangkok time on 20 October, with a wrong release time and a severity score of 10.0 instead of the real 9.2, the PHP Foundation says. No technical details leaked.

PHP then moved the release forward a day, from 22 October to 21:00 Bangkok time on 21 October.

After the leak, Calif mistakenly published a video of its PoC breaking into several targets. The foundation says the video helped speed up the development of attack code.

At 14:41 Bangkok time on 21 October, more than six hours before the agreed release, Chainguard broke the embargo, the agreement not to publish early, by releasing images containing the fix. That let attackers study the patch in advance, the foundation says.

PHP 8.2 support ends on 31 December 2026

The next date to watch is 31 December 2026.

PHP 8.2 reaches end of life that day and will get no more security fixes, the PHP project says. W3Techs puts more than 1 in 4 PHP 8 websites (27.7%) on version 8.2.

Even if those sites move to 8.2.35 this week, they must upgrade again, to 8.3 or later, within ten weeks. If your host manages PHP for you, ask when it will move you.

FAQ

How do I check if my website is affected?

Run php -v on the server or look up the version in the hosting control panel. Anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 in its series, or 8.1 and older, is exposed unless your Linux distribution or host has added the patch. Some keep the old version number, so check their notice too.

Will updating WordPress fix it?

No. The flaws are in PHP, so the server's PHP must be updated, by you or your host.

Has anyone used the flaws in attacks?

PHP's security team found no working exploit among the PoC code circulating at release. ThaiCERT says such code is now public, and Cloudflare says it has seen attack traffic aimed at its customers.

What if my server runs PHP 8.1 or older?

The PHP project no longer releases updates for these versions, beyond minimal source patches for 7.4, 8.0 and 8.1. Ask your Linux distribution or host for a backport, or move to a supported version. Until then, use PHP's interim settings; where even those are impossible, ThaiCERT suggests considering taking the server offline or limiting access to approved networks.

Sources

• PHP: Security advisory, critical remote code execution vulnerabilities
• PHP: PHP 8.2.35 Released!
• The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
• ThaiCERT: แจ้งเตือน พบช่องโหว่ PHP2Shell เสี่ยงถูกควบคุมเซิร์ฟเวอร์จากภายนอก
• Wiz: PHP2Shell, AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
• OpenAI: Patch the Planet, global response coordination as agents uncover critical vulnerabilities
• TechCrunch: PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability
• Google Cloud: Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
• W3Techs: Usage statistics of PHP
• W3Techs: Usage statistics of PHP version 8