AI helped find 2 critical PHP flaws. Every PHP web server needs this update

On October 21, the PHP project released fixes for two critical vulnerabilities that let an attacker run code on a web server without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's own advisory tells every user to update immediately.

WordPress and many custom business systems run on PHP. If your company has a website, an e-commerce store or an internal portal built on it, this applies to you.

Who is at risk

PHP says the risk covers every installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the most exposed, with a working exploit in which a single unauthenticated request triggers the attack before any of your application code runs.

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The first comes from how PHP handles running out of memory partway through a request. The second lets internal state from one request survive into a later request handled by the same worker.

PHP 8.1 and older no longer receive updates from the PHP project. Because of how serious these flaws are, the PHP security team published minimal source patches for 7.4, 8.0 and 8.1, and Linux distributions and long-term support vendors received fixes in advance.

AI found them first

A security research firm found one of them using OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet program, and a second security company independently found and reported both. OpenAI then coordinated a response with the PHP maintainers, other security providers and government agencies, so that fixes and protections were ready before the details went public.

OpenAI calls this one of the most impactful security issues in recent memory. It says these are among several significant vulnerabilities it has already found, and it expects similar findings to rise sharply in the coming months. If models can help defenders find flaws like these, attackers can use them too.

OpenAI has committed $1 billion in subsidized access to its Daybreak security tools for organizations with limited security resources that protect essential services. It has also proposed a 5-stage framework for responding to flaws like this one, from validating the fix to publishing guidance once a patch is out.

What to do this week

Find every PHP installation you run, including old marketing sites, vendor-built portals and staging servers. Check the version. Anything below the fixed releases needs updating, and anything on 8.1 or older needs either a vendor backport or an upgrade plan.

If you cannot update right away, PHP's advisory lists interim settings that reduce exposure, such as switching off session upload progress and lowering the maximum request size. The advisory is clear that these settings do not make a server safe. Treat them as a stopgap measured in days.

Ask your hosting provider and any agency that maintains your sites whether they have patched, and get the answer in writing. And check your logs for unusual requests since October 21, because public details make exploitation easier.

What it means beyond this patch

For Indonesian companies, the lesson is about pace. If AI keeps turning up critical flaws in widely used software, patching becomes a weekly operating routine. Companies that know exactly what software they run, and who is responsible for each system, will be able to act in hours. Companies that don't will spend the first day just finding out what they own.