AI Found Memory Flaws in the PHP Engine That Let an Attacker Take Over Servers Running Most of the Web The PHP security team released emergency patches on October 21 for two critical vulnerabilities in the language’s core engine. Both carry a CVSS v4.0 score of 9.2. Successful exploitation gives an unauthenticated remote attacker code execution as the web worker on any server running a vulnerable PHP version. PHP runs on roughly 70 percent of websites whose server-side language is known, according to W3Techs measurements that have held in that range for years. WordPress, Drupal, Joomla, Magento, Laravel, and plain scripts are all exposed when the underlying interpreter is. The issues are tracked as CVE-2026-109618 and CVE-2026-109619. They are not bugs in application code. They sit in the engine’s handling of request memory and fatal errors. Wiz Research reported the first of them in August after using its Atlas system together with Gemini 4 Argon and GPT-5.6 Sol. The models helped locate the conditions, chain the memory effects, and adapt the resulting exploits across PHP versions, SAPIs, and heap layouts that a single researcher would otherwise have spent months mapping by hand. A working unauthenticated proof of concept against current WordPress and Drupal containers was ready within days of the initial finding. The company later posted a technical write-up under the name PHP2Shell. The core mechanism is the engine’s use of longjmp() to abort a request on out-of-memory. PHP treats memory exhaustion as fatal and jumps out of the current context rather than running normal cleanup that might itself allocate. In several paths—multipart form parsing that expands headers or nested fields beyond the apparent post_max_size and memory_limit, session upload-progress handling, and certain error-backtrace or OPcache persistence steps—request-owned structures are allocated and then left partially initialized or still referenced from process-global state when the jump occurs. The request heap is later freed, but the globals (BG(unserialize), EG(last_fatal_error_backtrace), session identifiers, and similar) continue to point at the now-invalid memory. A later request processed by the same worker can read or write through those stale pointers before normal initialization replaces them. With a controlled heap layout the result is a use-after-free that yields arbitrary read or write and, in the demonstrated cases, full code execution. One advisory describes the OOM path in detail: a multipart request can force allocation failure during startup or early parsing; longjmp() skips the matching reset; shutdown or the next request’s early diagnostics then operate on the corrupted state. The companion advisory covers the broader stale-global case, where fatal errors, non-fatal diagnostics during shutdown, or interrupted session operations leave request memory reachable across workers. Both were confirmed to produce unauthenticated remote code execution under default limits on common configurations such as Apache mod_php with prefork. Memory disclosure of other requests’ data (credentials, tokens, keys) is also possible. The flaws have been present since at least PHP 5.4; every version released in the last decade is affected by at least one of them. Patches are available for the supported branches: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older branches receive no official fix. Estimates of exposed internet-facing hosts that still advertise a version range from roughly 1.3 million upward, with a substantial fraction on end-of-life releases that cannot be updated in place. Some hosts have already disabled session.upload_progress as a temporary mitigation while waiting for the packages. Early scanning and exploitation attempts were reported on the morning of the release. 1 of 2

Shopping on a Thursday morning, 1945.