OpenAI helped discover two PHP remote code execution vulnerabilities; PHP releases four versions to fix them

Zhihui Dong October 22 news: Yesterday, U.S. AI company OpenAI disclosed that its participation in security research work helped discover two serious security vulnerabilities in the open-source programming language PHP, namely that attackers, under specific conditions, can execute code on affected servers without authentication. Currently, the PHP project released a security update on October 21 to fix these two vulnerabilities.

This vulnerability investigation was supported by Patch the Planet, an open-source software security project initiated by OpenAI. The project uses AI models and security engineering methods to help software maintainers and security researchers discover, verify, and fix serious vulnerabilities.

According to disclosure by The PHP Foundation (a nonprofit organization that supports PHP development and maintenance), security company Calif launched a PHP security audit on July 30, 2026.

Among them, the PHP core maintenance team led vulnerability remediation and version releases, while OpenAI and cybersecurity companies Wiz and Cloudflare provided technical and coordination support to help relevant organizations complete protection preparations before the vulnerabilities were made public.

1. The two vulnerabilities involve PHP's underlying mechanisms, with the highest score reaching 9.2

According to an announcement released by The PHP Foundation on October 21, this fix involves two serious remote code execution vulnerabilities, numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS 4.0 score of 9.2.

The CVSS 4.0 score is a standard used to measure the severity of cybersecurity vulnerabilities, with a score range of 0.0 to 10.0. The higher the score, the more serious the vulnerability usually is.

The first vulnerability, CVE-2026-109618, is related to memory corruption caused by memory exhaustion (OOM). When a request hits PHP's memory limit at a specific timing, the program may leave internal data that has not been fully initialized, and the subsequent cleanup process may treat it as valid data, thereby causing memory corruption.

In the Apache mod_php runtime environment, attackers can trigger this issue through requests without authentication, and researchers have verified the possibility of remote code execution under the default configuration.

In the PHP-FPM environment, researchers also confirmed the remote code execution risk through application code paths.

The second vulnerability, CVE-2026-109619, involves stale global state and a use-after-free issue. When the program encounters a fatal error under specific circumstances, the internal state may still point to memory used by a previous request.

Subsequent requests handled by the same worker process may continue to access this already freed memory, causing the worker process to crash, and researchers have also verified the possibility of remote code execution in real application scenarios.

Both vulnerabilities involve PHP's underlying memory management and error handling mechanisms, and almost every request may pass through the relevant code paths.

Because these mechanisms are at the core of PHP's execution flow, the fix work must not only eliminate security risks but also take into account backward compatibility, runtime performance, and the normal operation of a large number of third-party extensions.

The official PHP announcement stated that all PHP installation environments that handle web requests may be affected, including runtime modes such as PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.

Among them, the Apache mod_php environment has the highest risk, and researchers have proven that attackers can trigger the attack before application code runs.

The PHP project has released four maintenance versions, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, to fix the above vulnerabilities.

Officials recommend that users upgrade to the corresponding fixed versions as soon as possible. For users who cannot upgrade temporarily, some temporary measures can reduce the risk of specific attack paths, but they cannot replace a complete update.

2. AI-assisted investigation reveals the impact of the vulnerabilities, and PHP remediation work continues for months

This security investigation did not begin in 2026. The PHP Foundation disclosed that in 2024, PHP underwent an external security audit that had not been conducted for many years.

The audit was organized after The PHP Foundation received funding support, with the specific work carried out by security company Quarkslab.

While fixing issues found in the audit, a PHP core developer employed by The PHP Foundation first discovered abnormal signs related to memory exhaustion.

The researcher at the time speculated that this issue might have an exploitable attack path, but had not yet found a clear remote code execution method.

The PHP security team then tried multiple fix approaches, but each approach faced different limitations, including breaking backward compatibility, introducing new denial-of-service risks, or requiring a large number of third-party extensions to be modified in sync.

Because no clear remote code execution path had yet been found, and because the number of core developers familiar with PHP's underlying mechanisms was limited, the remediation work stalled and restarted multiple times.

On July 30, 2026, The PHP Foundation included the project in OpenAI's Patch the Planet program, with Calif conducting further security auditing.

On August 11, Calif researcher Ryan A reported an attack path that could achieve remote code execution, whose root cause was exactly the memory exhaustion issue discovered by the PHP team in 2024.

OpenAI independently reported the same root cause on the same day and submitted other attack paths on September 18. Wiz submitted related findings on August 24.

These reports made clear to the PHP team the full impact the original memory issue could cause.

Starting August 11, fixing the issue became the top priority for The PHP Foundation's security team. Because the vulnerability involved PHP's underlying mechanisms, the fix required trade-offs among security, compatibility, and performance; The PHP Foundation assigned multiple people to work on it continuously and coordinated with external researchers, software distributors, and service providers.

During this period, PHP's security workflow also changed. In May 2026, The PHP Foundation established the Ecosystem Security Team, responsible for assisting the security team with report triage, coordination, and code hardening.

The foundation also gradually brought in personnel to handle security reports, vulnerability fixes, and system hardening, and used tools such as OpenAI's Daybreak Red to validate reports and exploit methods.

On October 20, the identifiers of the two vulnerabilities began spreading on online forums and social media, and related posts also incorrectly gave a release time and CVSS scores.

The PHP project therefore issued an early advance notice and moved its security update, originally scheduled for October 22, up to October 21, to give software distributors time to prepare update packages.

Ultimately, the PHP project released four maintenance versions on October 21, fixing the two vulnerabilities.

The incident also prompted The PHP Foundation to re-examine its security decision-making process, hoping to enable faster management involvement in fixing complex vulnerabilities and to reduce delays caused by decision-making mechanisms and insufficient resources.

OpenAI said the incident demonstrates the potential of AI-assisted security research.

AI models can help researchers discover software vulnerabilities with broad impact and buy maintenance teams time to fix them before the vulnerabilities are disclosed. OpenAI calls this phase the "Defender's Window," when maintainers and security service providers have the opportunity to discover issues, develop patches, and prepare protections before attackers do.

However, vulnerability discovery is only part of the overall security response process.

The PHP Foundation disclosed that since July 1, 2026, the team has published vulnerability advisories for 15 CVE identifiers while also handling more than 100 reports ultimately judged invalid, duplicate, or unreproducible.

The compatibility, performance, and third-party extension adaptation issues faced in this PHP vulnerability fix are also difficult to resolve automatically just by having a model discover the vulnerability.

This exposes the real-world pressure in open-source software security maintenance. PHP is widely used in scenarios such as government services, online stores, banks, and media websites, but its underlying security work still relies on a limited-sized core developer team and the funding and personnel support provided by The PHP Foundation.

To address this issue, OpenAI proposed a coordinated response framework for major vulnerabilities in widely used software, covering vulnerability validation and remediation, advance notification to affected organizations, coordination with governments and infrastructure service providers, preparation of updates, and deployment guidance after patch release.

OpenAI also said it will provide model access, security engineering support, and response coordination through programs such as Patch the Planet to help more open-source projects address security issues.

For widely used open-source foundational software such as PHP, AI can improve vulnerability investigation efficiency, but it cannot replace the role of professionals in maintenance.