What was disclosed
PHP’s October 21 advisory names two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. It lists fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update. It covers PHP installations serving web requests; exposure and demonstrated attack paths differ by configuration.
OpenAI’s October 21 account says Calif identified a flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. Wiz describes using its own Atlas tooling, Gemini 4 Argon, and GPT-5.6 Sol. These are the organizations’ accounts of their research. PHP’s maintainers led the fixes and release.
A version number is only part of the check
PHP says distributions and long-term-support vendors received patches in advance. A vendor can incorporate a security fix while retaining an older-looking version string. Match the actual package and provider advisory to both CVE identifiers; do not decide from the major version alone.
For managed hosting, ask the host whether the PHP serving your site includes both fixes and whether the required activation is complete. Updating a website plugin is a different layer. PHP says its interim configuration measures are incomplete substitutes for an update. Follow the current maintainer and provider guidance rather than copying a generic workaround.
Our take
For experienced technicians and small-business site owners, the useful outcome is a verified fix running in the service that handles requests. AI-assisted discovery does not remove the need for maintainer review, compatibility checks, and an actual deployment record.
Ask for the installed package build, the matching advisory, and confirmation that the updated service is active. Preserve a working recovery route when planning a change. This is reporting and an editorial checklist; we have not scanned servers, tested an exploit, or verified any reader’s hosting configuration.