AI-Discovered PHP Vulnerabilities Allow Unauthenticated RCE — Even a 'Hello World' App Is Affected
On October 21, 2026, PHP released emergency security updates addressing two vulnerabilities that both lead to unauthenticated remote code execution. One line from the official disclosure should worry every PHP developer: the affected applications don't require any flawed application code — an app that only outputs "Hello World", running on an affected version, is equally vulnerable. The bug isn't in your code; it's in the PHP engine itself, in the gap between requests.
Both vulnerabilities carry a CVSS score of 9.2.
Vulnerability 1: CVE-2026-109618 (memory exhaustion leading to memory corruption)
PHP uses memory_limit to cap memory usage per request, forcibly aborting the request when exceeded — implemented as a C-level longjmp that jumps execution directly back to the request's starting point. The problem is that this "jump" is indiscriminate: if it lands at a moment when the request's internal data is only partially initialized — for example, while a multipart file upload is mid-parse — the subsequent cleanup code treats the half-finished data as valid and "frees" it as usual. Whatever lies in that uninitialized memory, the attacker can prepare in advance. Freed pointers and reused memory may all be attacker-controlled.
Vulnerability 2: CVE-2026-109619 (residual global state)
When a request dies — for instance, triggering a fatal error — its internal state survives in the process. The next request served by the same worker may use this "past-life" state before normal initialization completes. Cross-request contamination.
Why Hello World is affected
The two flaws live at opposite ends of the same gap: one in the interruption of a request's "birth", one in the residue of its "death". The trigger entry point is a multipart/form-data request body — the standard format for file uploads and most forms — parsed by the PHP engine before any application code runs. That is why "Hello World is affected". Researchers demonstrated unauthenticated code execution on the latest versions of 11 applications: Magento, WordPress, Drupal, Joomla, MediaWiki, phpMyAdmin, Nextcloud, Laravel, Symfony, Roundcube, and WHMCS. Apache's mod_php mode is considered highest risk.
The discovery story
The "OOM leading to memory corruption" class of issue had been discussed in the security community for decades; the consensus was that it existed in theory but was not practically exploitable, so nothing was done. In 2024, a PHP core developer discovered the OOM issue during internal code review; the team failed to reach consensus on a fix, and since no exploitation method was known, the fix was shelved. In August 2026, the bug was independently found three ways: Ryan Austin of California security firm Calif, a four-person team at Wiz Research, and OpenAI — Calif's find came through OpenAI's "Patch the Planet" project, with Codex Security participating. Thirty years of "impractical" was overturned by a drop in execution cost.
Timeline
- Aug 1: Calif reports the first issue
- Aug 24: Wiz joins
- Oct 20: details leak accidentally
- Oct 21: patch released ahead of schedule. Cloudflare observed attacks six hours before the patch (07:43 UTC).
What to do
Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP 8.1 and older have no official fix. If you can't upgrade immediately, block multipart/form-data requests at the gateway (breaking all file uploads) as a stopgap; failing that, take systems offline.
PHP powers roughly 70% of websites. What has been exposed this time is the seam between requests — a seam no one believed could be stepped into for thirty years.
References: php2shell.com (joint disclosure by Wiz / Calif / OpenAI / PHP); CERT-EU Security Advisory 2026-018; Sansec PHP2Shell analysis (2026-10-21).