AI found a critical PHP flaw. The bigger failure began in 2024.
The New Stack Steven J. Vaughan-Nichols ● Covered by 13 sources
PHP fixed two critical flaws; some sites went offline while admins waited to patch. The bigger mess is the disclosure fight and a bug maintainers had seen signs of in 2024.
Based on reporting by The New Stack, Steven J. Vaughan-Nichols — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Some websites went dark on Wednesday because operators chose caution over convenience. They took services offline while waiting for fixes to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. That did not mean the sites had already been breached. It did mean the panic was justified: PHP sits under roughly 70% of websites, and even a bug in the language can become an internet-scale headache fast.
The patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older branches need a supported upgrade or a backport from a distributor. WordPress told site owners to update PHP, but these fixes are not a WordPress update issue. The language, not the CMS, is the weak point here.
The real story, though, is how the fix escaped the lab before the coordinated release. The PHP Foundation says details began leaking on October 20, followed by an accidentally published proof-of-concept video. Then Chainguard CEO Dan Lorenc released patched container images more than six hours before the October 21 release, saying he believed reports of active exploitation justified breaking the embargo. The foundation says Chainguard should not have published built images early, because attackers could study the fix while other users were still waiting.
There is also a slower failure buried underneath the drama. PHP maintainers had seen signs of the out-of-memory problem behind one of the CVEs during a 2024 audit, but the path to remote code execution only became clear this August. The foundation called the delay a structural failure tied to process and resources. That is not a flattering sentence, but it is an honest one.
OpenAI’s Patch the Planet initiative fed into the whole mess, with Calif using GPT-5.6 Sol to find a route to remote code execution and reporting it on August 11. OpenAI independently reported the same underlying issue that day, and Wiz reported its findings on August 24. The message for operators is plain: patch now, and review logs for signs of trouble going back to October 17.
My take — AI-written commentary, not fact-checked reporting
This is what happens when critical infrastructure is maintained like a volunteer side quest and then handed AI accelerants. The embarrassing part isn’t just the leak; it’s that a bug this broad can sit there until the internet starts sweating. Open source keeps running the modern web, but it cannot keep being told to do more with less and somehow also move faster than machine-assisted attackers.
Read more about this at: The New Stack