On 21 October 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow an attacker to execute code on an affected server without being authenticated. Depending on the application’s permissions, they could steal or alter data, install malware or disrupt services. The compromised server could also provide a foothold inside the organization’s network, allowing the attacker to move laterally and compromise other systems.
Organizations running PHP should identify affected installations and apply the relevant updates, prioritizing internet-exposed services because an attacker doesn’t need an account. Examples include WordPress and Drupal websites, as well as custom PHP web applications. PHP security advisory.
Responding to the PHP vulnerabilities
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or the relevant vendor backports. Where prompt patching is not possible, organizations should follow PHP’s temporary mitigation guidance and consider restricting access or taking affected services offline. The temporary measures don’t provide a complete fix. PHP guidance.
Despite the attention these vulnerabilities have received, organizations don’t need a fundamentally different process to manage them. Indeed, we have been patching vulnerabilities in internet-facing software for decades, and the same vulnerability management practices apply here. An asset inventory should cover software, versions and dependencies. Teams can use it to identify affected systems and prioritize those exposed to attack. Teams then need to deploy and test updates. Verification should confirm that affected services are running patched versions.
Finding vulnerabilities and developing exploits with AI
Wiz reports using AI to find the PHP vulnerabilities and develop working exploits. Chainguard’s CEO also says his team used a frontier model to independently rediscover the issue after being told that a PHP vulnerability was forthcoming, and built an exploit before the coordinated release. In that account, AI helped turn limited advance information into a vulnerability finding and an exploit while organizations waited for public patches. Wiz’s research, Chainguard’s account.
The discussion around Mythos had already made clear that AI could help malicious actors find vulnerabilities and develop exploits faster. Some predictions of a catastrophic “vulnpocalypse” relied heavily on hype and fear, but this week’s events confirm that AI can help find and exploit critical vulnerabilities in software widely deployed for years. More frequent disclosures and less time to remediate were foreseeable consequences of those capabilities. That could bring back a pattern familiar from the early 2000s, when successive vulnerabilities in internet-facing software made urgent patching a recurring part of operating those services.
The consequences could be greater today because society has become much more dependent on connected systems. Healthcare, payments and public services now rely extensively on digital infrastructure and shared suppliers. A compromise at one provider can therefore disrupt services across several organizations. More frequent vulnerabilities would mean repeated remediation across larger, more interconnected estates, where delays can affect the delivery of essential services.
The two Linux kernel vulnerabilities disclosed this week show what an organization may have to deal with alongside PHP: reports of possible remote code execution became public while fixes were still in development branches, before a coordinated release of updates. Affected organizations therefore need to assess exposure and temporary mitigations while waiting for those updates. As more flaws are found, teams should expect to repeat that work more often, including when several urgent issues need attention at once. Linux kernel report, kernel maintainer response.
Improving inventory and patching with Generative AI
Organizations that have been getting by with gaps in discovery, inventory or patching will find that harder as more vulnerabilities are found. They cannot rely on widely used internet-facing software having already been thoroughly vetted. Without an accurate inventory, teams can spend much of the response establishing which assets are affected before remediation can begin. Keeping discovery and inventory current lets teams assess faster and gives them more time to test and deploy updates.
Organizations should start an internal program to integrate AI into their vulnerability management and patching processes. Adopting an AI tool doesn’t automatically improve inventory or speed up patching. Organizations need to design and implement workflows around their infrastructure, then test and tune them against actual remediation tasks. The work should improve asset discovery and inventory accuracy and reduce the time needed to identify affected systems, prepare updates and verify remediation. Achieving those improvements requires integration with inventory, testing and deployment tools, while retaining change review and deployment controls. Building and exercising these workflows before the next urgent disclosure will leave teams better prepared to respond.
OpenAI’s PHP version checker already provides Codex skills that allow an operator to ask an agent to check PHP versions against security guidance. Although it doesn’t patch hosts or prove exploitability, it is an example of a check an organization can incorporate into its response.
If you need support identifying vulnerable PHP hosts, validating remediation, or improving your vulnerability management capabilities, Reversec’s specialists are available to help. Contact our team to discuss your environment and next steps.
