Two critical flaws (CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10) in PHP, which is used by almost 70% of websites, let attackers run code on a server without logging in. Facts as of 23 October 2026; the story is still developing.
1 What happened
On 21 October, Finland’s government website was partly disabled, Oxford and Edinburgh city councils went offline, some BBC programme pages became unavailable, and the Office for Budget Responsibility took its site down. PHP said there were no complete mitigations, and the UK’s NCSC told organisations that could not update fast to consider going offline. Fixes arrived at 14:00 UTC (7:30 pm IST), but Cloudflare’s CEO said there were already thousands of exploit attempts in the ten hours before the announcement, and millions after.
2 What is broken
Two memory-handling bugs. In the first, PHP runs out of memory mid-request and later treats half-built data as finished. In the second, leftovers from one visitor’s request linger and trip up the next, with a confirmed attack path through a session upload feature that has been on by default for over a decade. Because the flaw is in PHP and not in any site’s own code, updating WordPress does not fix it. The host’s PHP version has to change.
3 How AI found it
Calif researcher Ryan Austin found the flaw in August using an OpenAI model, and OpenAI independently reported the same root cause that day. Wiz later found both flaws on its own. The fix was planned for 22 October but was brought forward after details of the work leaked online, shrinking the head start that finding it early was meant to give defenders.
4 Who is exposed
PHP patched four branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. About 35.8% of WordPress sites run PHP 8.1 or older, which gets no official fix (only minimal source patches for 7.4 to 8.1), and 8.2 itself reaches end of life on 31 December. Whether the flaws are being exploited at scale is disputed. Amazon, watchTowr and Hadrian say yes. CISA had not seen it at the time of its alert, and I found no confirmed break-in at a named site.
5 What to do
Site owners: check your PHP version (in WordPress, Tools > Site Health > Info > Server), ask your host if it has patched, and aim for PHP 8.3 or newer.
Security teams: patch internet-facing systems first, inventory products and containers that bundle PHP, and where you cannot patch, set session.upload_progress.enabled=0 and restart workers. Hunt for unexpected processes, files, accounts or outbound connections.
Everyone else: nothing to install, since the fix is for whoever runs the sites you visit. Watch for scams and phishing, and use unique passwords.