On October 21, researchers disclosed critical vulnerabilities in the PHP runtime after using frontier AI models to investigate flaws that had survived for years. PHP powers a large share of websites, including applications built on WordPress and Drupal. The flaws, CVE-2026-109618 and CVE-2026-109619, can permit unauthenticated remote code execution on affected installations.
This matters to any organization with a customer portal, supplier application, website, hosted business system or third-party appliance using PHP. An application can be well maintained while its underlying runtime remains exposed.
What Changed This Week
The PHP project released fixes on October 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On October 23, it described a separate, narrower issue, CVE-2026-115560, that those fixes do not address; affected configurations should temporarily disable session upload progress pending a future update.
Amazon reported attempted exploitation in its honeypot telemetry as early as October 17, before public disclosure. That establishes observed attempts, not confirmed compromise of customers. AI is accelerating both vulnerability research and the development of attack techniques, reducing the time defenders have to act.
Technology That Can Help
Three product capabilities are worth reviewing together. Exposure management and software inventory identify where PHP runs, including containers, legacy servers and third-party software. Web application and API protection can reduce exposure while teams patch. Endpoint detection, SIEM and response automation help investigate suspicious processes, files and outbound connections.
Cloudflare introduced full-transaction WAF detection this week, combining request and response signals for PHP2Shell protections. It also described how its existing invitation-only AI vulnerability-discovery service connects source-code findings to live traffic and proposes patches and WAF rules for customer review. This is an emerging capability to evaluate, with human validation and clear data-access boundaries. Blocking an HTTP response cannot undo a harmful action already executed on the origin server. The PHP update remains essential.
Where to Start
- Identify every PHP runtime behind public websites, APIs, containers and vendor-managed applications. Check running versions and ask suppliers for confirmation.
- Patch to a supported fixed release or verified vendor backport, restart affected workers and verify the running version after deployment.
- Confirm WAF protections and origin access restrictions. Where patching is delayed, consider isolation and document the business decision.
- Review web, application, authentication and EDR logs from at least October 17 for unexpected PHP child processes, file changes, accounts or outbound connections.
- Check the October 23 session-upload-progress advisory separately; disable the feature where required until a fix is available.
The Longer-Term Decision
Ask whether your current exposure-management, application-security, WAF and detection tools can discover vulnerable components, deploy temporary controls, verify remediation and preserve investigation evidence quickly enough. Test that workflow during a controlled exercise.
Cybersafer helps organizations compare and source suitable technologies, validate the architecture and coordinate implementation with their teams and delivery partners.
How quickly could your team identify and contain a critical flaw in a widely used component?
Sources: PHP Security Team; Canadian Cyber Centre; Wiz research; Cloudflare WAF; AWS threat intelligence; OpenAI / Cloudflare case study.
Discuss this topic → More insights