PHP Patches Two Critical Flaws as OpenAI Codex Security Gets Credit

PHP released fixes Oct. 21 for two critical vulnerabilities that can let an unauthenticated attacker execute code remotely, with OpenAI Codex Security among the research efforts credited in the coordinated disclosure.

Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws involve out-of-memory corruption and stale global state. Both carry a CVSS v4.0 score of 9.2. The bugs affect PHP installations processing web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. A combined exploit was demonstrated against WordPress, Drupal and Joomla, but the vulnerable code is in PHP itself.

Administrators can install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The PHP project has ended updates for PHP 8.1 and earlier, though some distributions and long-term support providers may backport patches. No complete mitigation is available, and updating is the only safe option.

Calif, OpenAI Codex Security and Wiz received credit for research and responsible disclosure. Calif used GPT-5.6 Sol to identify a critical flaw, while Wiz independently discovered both vulnerabilities. For crypto firms, exposure depends on whether their web infrastructure runs an affected PHP version.