The PHP project published, on Wednesday, October 21, 2026 at 14:00 UTC, versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 of its programming language. They fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on the CVSS v4.0 scale, which can allow remote code execution without authentication. A CVE identifier designates a referenced security flaw, and the CVSS score measures its severity.
- Deux failles critiques permettent l’exécution de code à distance sans authentification dans PHP.
- Le problème était identifié depuis l’audit de 2024, mais le correctif a stagné faute de consensus et de ressources.
- Des chercheurs, dont l’équipe Wiz, ont découvert la faille en quelques jours grâce à des modèles d’IA.
- Les versions maintenues ont été corrigées le 21 octobre 2026, alors que les branches 8.1 et antérieures doivent être isolées puis migrées.
According to the publisher, all installations serving web requests are affected, under PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed, with the risk considered highest with mod_php. On the same day, CERT-FR updated its alert CERTFR-2026-ALE-014, and the Ministry of the Interior shut down its exposed sites, including prefectures. The timeline published by the PHP Foundation indicates that the flaw behind the first vulnerability had been identified since 2024, without a known exploitation vector.
A flaw identified during the 2024 audit
In 2024, PHP underwent its first external security audit in years. Funded by the German Sovereign Tech Agency, organized by OSTIF, and conducted by the French company Quarkslab, this audit led a core PHP developer to spot, while fixing one of the reported issues, the first signs of a flaw related to out-of-memory errors. An exploitation was then theorized, without a concrete vector.
The fix then stalled on trade-offs. Each approach considered broke compatibility, opened a risk of denial of service, or required changes to many third-party extensions, impossible to coordinate. The security team, which decides by consensus, saw the project “stall and restart several times over months.” The foundation writes that “the delay was a structural failure,” due to this decision-making mode and a lack of resources.
Calif, OpenAI, and Wiz: a summer of demonstrations
As part of the Patch the Planet program, the company Calif began a PHP audit on July 30, 2026. On August 11, its researcher Ryan A. reported an unconditional remote code execution, from the same root cause as the 2024 flaw. OpenAI, whose foundation credits the Codex Security team, reported the same cause the same day. Wiz Research followed on August 24 with other attack vectors. From August 11, the foundation writes, the fix became the priority of its entire security team.
Wiz indicates it used its Wiz Atlas tool, Google’s Gemini 4 Argon, and OpenAI’s GPT-5.6 Sol. Its timeline places the discovery of the first flaw on August 19, code execution confirmed on August 20 on Drupal and August 21 on WordPress, and the report to PHP on August 24. According to the company, a single researcher, with these models, completed in one week what would have taken months for a top team. The foundation also lists 15 CVEs published since July 1 and more than 100 reports dismissed as invalid, duplicates, or non-reproducible.
The release was scheduled for October 22. On October 20 around 15:00 UTC, the two CVE identifiers began circulating on forums and social networks, with an incorrect release time and a false CVSS score of 10. According to the foundation, no technical details leaked. PHP moved up its pre-announcement and release to October 21. Chainguard published, on October 21 at 07:41 UTC, images including the fix more than six hours before the release, which the foundation calls a unilateral embargo breach.
Isolate then migrate, the CERT-FR directive
CERT-FR lists as affected all versions 5.x, 6.x, 7.x, 8.0.x, and 8.1.x, as well as branches 8.2 to 8.5 prior to the fixed versions. For branches no longer maintained by the publisher, it recommends isolating equipment then migrating to a maintained version. Temporary workarounds, in PHP configuration or on an application firewall, are not qualified by CERT-FR. According to Anssi, more than 600,000 servers use PHP on the French Internet. The Ministry of the Interior put its exposed sites into preventive maintenance, according to a statement reported by AFP. On October 22 at 08:33 Paris time, the CNIL site and impots.gouv.fr displayed a maintenance page, as did the Seine-Saint-Denis prefecture site. None of these pages mention PHP.
Cloudflare says it observed attack traffic targeting its clients, and attackers modifying their requests to bypass its filtering rules. According to the foundation, no functional exploit had been identified at the time of publication. As of the indicated date, none of the cited sources report a successful intrusion.
Maintained versions received their fix on the day of disclosure. The main risk concerns servers still running PHP 8.1 or earlier, which the project no longer updates. For PHP 7.4, 8.0, and 8.1, its security team provided minimal backports, intended for those compiling from source. The PHP Foundation asks companies, hosts, and administrations relying on PHP to fund it, as the engine’s security still depends, it writes, on “a small group of developers funded by the foundation and some volunteer help.”
