PHP published critical security updates; Wiz reports frontier models helped turn core memory-safety flaws into working exploits.
PHP patches two critical core-engine flaws found with frontier models
2026-10-21Verified announcementADOPT
PHP released security updates for two critical core-engine vulnerability groups that can enable unauthenticated remote code execution or process-memory disclosure. Wiz reports that frontier models helped researchers turn long-standing memory-safety flaws into working exploits across representative WordPress, Drupal and Joomla deployments. The flaws are in PHP itself; affected servers need patched PHP releases.
What this means for you
For teams operating PHP or using AI for vulnerability research, this changes both immediate patch priority and the cost model of exploit development. The researcher headline that PHP powers 70% of websites is not the same as 70% of internet systems being exploitable; exposure depends on PHP version, configuration and deployment.
Evidence & related material
Technical details & scores
| Vulnerabilities | CVE-2026-109618 and CVE-2026-109619; memory disclosure and unauthenticated RCE paths |
|---|---|
| Patched Versions | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 |
| Demonstrated Targets | representative WordPress, Drupal and Joomla deployments; flaws are in PHP core |
| Ai Role | Wiz reports using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol for discovery, exploit development, detection and patch validation |
| Evidence Boundary | AI contribution and exploitability details are researcher-reported; PHP independently confirms critical security releases |
| Time Basis | Wiz published 2026-10-21T13:59:59Z, inside the configured overlap but before the prior checkpoint; late discovery |
Technical impact 5
Engineering value 5
Adoption signal 5
Maturity 5
Verification cost 1
Risk 5