PHP shipped emergency releases on 21 October for CVE-2026-109618 and CVE-2026-109619, two flaws in the language engine that allow unauthenticated remote code execution. Both are scored 9.2 on CVSS v4.0. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

A 10.0 circulated before the release. It was wrong, and it came from the leak rather than from PHP.

Where they came from

This is the part that makes it more than a large patch.

OpenAI published an account the same day. In its words, "Calif identified a critical flaw using GPT-5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities." PHP's maintainers led the fix. OpenAI, Wiz, Cloudflare and others contributed research and prepared protections before disclosure.

OpenAI's claim about the significance is direct: "To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window for maintainers and security providers to prepare fixes and protections ahead of disclosure." It calls the pair "one of the most impactful security issues in recent memory" and says it expects similar findings "to increase sharply in the coming months".

Calif is the same firm whose researchers took a 1988-vintage OpenBSD counter to local root last week. GPT-5.6 Sol is the same model family XBOW used to build the Chrome chain Google paid $250,000 for. Three internet-scale findings in a fortnight, from the same small set of tools.

The window, and how it closed

The coordinated response OpenAI describes is unusually institutional for an open-source language. It says it worked with the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA, as well as international partners, so that guidance would reach operators of critical systems before the flaws were public.

The release was scheduled for 22 October. It went out on the 21st, at 14:00 UTC, because the CVE identifiers leaked ahead of it.

So the Defender's Window was real, deliberately constructed, and then shortened by a day by something nobody in it controlled. watchTowr reports "active exploitation attempts" against both flaws. Cloudflare reported early attacks.

That is the honest shape of this: the head start worked, right up until it did not, and the margin was one day.

What the flaws are

CVE-2026-109618 is memory corruption on an out-of-memory condition: PHP leaves request data partially initialised after an allocation failure. CVE-2026-109619 is stale global state, where PHP keeps references to request data after the memory behind it has been freed.

Both vectors are identical and worth reading: network reachable, no privileges, no user interaction, high attack complexity. The complexity rating is the only thing standing between this and a worm, and complexity ratings describe the first exploit rather than the tenth.

Because the flaws are in the engine, applications are exposed regardless of their own code quality. Magento, Shopware and WooCommerce stores are affected because they are PHP, not because they did anything.

The workaround that is not one

Disabling session upload progress has circulated widely as a mitigation. It is part of one attack path for CVE-2026-109619, and it does nothing at all for CVE-2026-109618.

PHP's position is that updating is the only complete fix, and on this the project is plainly right. A partial mitigation published without that qualifier is worse than none, because it converts urgency into a sense of having acted.

What to do

  • Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Nothing else closes both.
  • Check what your hosting provider runs, not what your application targets. On shared hosting the version is not yours to choose and the exposure is still yours.
  • If you cannot update today, put a WAF in front of it and treat that as buying hours, not as a fix.
  • Do not rely on disabling session upload progress. It addresses part of one flaw.
  • If you run an e-commerce platform on PHP, assume scanning started before you read this. Two of this month's three exploited-in-the-wild stories here began within a day of public details.

What is not established

  • Whether anyone has been compromised. Active exploitation attempts are reported; successful exploitation is not.
  • How the CVE identifiers leaked, or from where.
  • Which of the two flaws Calif found and which Wiz found. OpenAI says Calif found "a critical flaw" and Wiz found both.
  • How much of the real-world attack surface the high-complexity rating actually protects.
  • What the government engagement produced in practice. OpenAI describes who was involved, not what they did.
  • Whether the coordination framework OpenAI proposes will be adopted by anyone else. It is a proposal, published by one participant.