PHP versions 8.2 to 8.5 receive a fix for two flaws rated 9.2 that allow code to be executed without authentication. Calif, Wiz and OpenAI had reported them.
The PHP project published on 21 October the versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They address two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10. Under certain conditions, they allow an unauthenticated attacker to run code on a server that runs PHP. The patches were advanced one day after the online circulation of CVE identifiers and a video showing an operating tool called " PHP2Shell". According to watchTowr, all versions since PHP 5, released in 2004, would be affected; Sansec expected massive attacks within 15 minutes of publication.
A fault identified as early as 2024, revived by audits assisted by IA
The PHP Foundation acknowledges that the memory management problem in question had been identified during an audit conducted by Quarkslab in 2024, without a concrete operating path being identified; In the absence of consensus on the correct correction, the work has stalled for months, a "structural failure" assumed by the foundation. On August 11, 2026, a Calif and OpenAI researcher reported on the same day a remote code execution related to this cause, followed by Wiz on August 24 and new OpenAI vectors on September 18. OpenAI reports having found these faults with GPT-5.6 Sol.
The Foundation also highlights the effect of AI on the flow of reports: 15 VECs published since July 1st and more than 100 invalid, duplicated or non-reproducible reports to be sorted. AI helps validate and consolidate reports, but each decision and corrective action remains human. Administrators are invited to update immediately.
Read the full article on the original source
Go to the source →