Article 313: PHP Shipped Two CVSS 9.2 Holes and Wiz Found Them With Three AI Models in a Week
PHP published an unusually blunt advisory on October 21: two remote code execution vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2, under the headline "update now." Fixes landed as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Version 8.1 and older get no official fixes, only minimal source backports, and 8.2 itself reaches end of life on 2026-12-31.
The mechanism is worth understanding because it is not an application bug. CVE-2026-109618 lets an out-of-memory error interrupt request initialisation so cleanup logic treats invalid data as valid. CVE-2026-109619 leaves request state alive after a fatal error, so a later request handled by the same worker reuses freed memory. Every PHP install serving web requests is affected: PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed. mod_php is the worst case, exploitable before any application code runs. Both flaws allow unauthenticated reads of passwords, tokens and PHPSESSID cookies out of server memory, and they reach WordPress, Drupal and Joomla.
The interesting part is how they were found. Wiz Research says a single researcher, working with the Wiz Atlas platform plus Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, spent about a week finding four bugs and building exploit chains. Wiz's blog says the same work would previously have taken a top team months. Timeline: found August 19, reported to the PHP team August 24, disclosed October 21.
Cloudflare had WAF rules live about nine hours before public disclosure, at 3:02 AM UTC on October 21, and reports seeing attack traffic before the news broke, with attackers mutating payloads to evade. The Dutch national cyber centre briefly took its own PHP-based site offline on the day. There is no complete mitigation short of upgrading, though operational mitigations reduce reachability: disable session.upload_progress, set fatal_error_backtraces=0 on 8.5, cap memory with cgroups rather than RLIMIT_AS.
Key Takeaway: The headline writes itself as "AI found a critical bug," and that framing gets the story backwards. Finding the bug was the cheap part - the expensive part was the decade of exposure before anyone looked. What changed is that a security budget of one researcher and a week can now cover a language runtime that a generation of human researchers wrote off as too well-trodden. That is a supply shock in defensive research, and it applies to every piece of infrastructure we assumed was audited because it was old. The uncomfortable corollary: if one researcher with three models can find four RCEs in PHP in a week, the same method works for whoever is not publishing a blog post. The genuinely defensible position is not better discovery, it is shorter patch latency - and the honest read of this week is that the internet's patch latency for mod_php was measured in hours only because the disclosure was coordinated. Cloudflare's nine-hour head start is the model to copy: detection ahead of disclosure, not a faster press release.
Sources: php.net advisory archive, 21 October 2026; Wiz Research, php2shell write-up; Cloudflare blog, WAF protection for php2shell CVEs; The Context, AI Frontier Daily Briefing 2026-10-22