Most security dramas have one villain. This one has two memory-corruption bugs, three AI-assisted research teams, one security vendor that shipped early, and an open-source project with a lot to say about it. If you run anything on PHP, and a big chunk of the web does, this is your week.

Two Bugs, Ten Years, One Nickname

PHP maintainers shipped emergency patches on October 21 for CVE-2026-109618 and CVE-2026-109619, a pair of remote code execution flaws now nicknamed "PHP2Shell." Both live in PHP's memory management and error handling. The first can be triggered by an unauthenticated request on Apache with mod_php before any application code even runs. The second abuses stale internal state to cause a use-after-free, and a researcher demonstrated code execution with it against a real-world application.

According to Wiz, every PHP version released in the last decade is affected by at least one of the bugs, going all the way back to 5.4. Researchers at Calif, OpenAI, and Wiz found the flaws between August and September, and all three said they used AI models to do it. The disclosure itself was bumpy: CVE IDs began circulating on October 20 alongside rumors with incorrect severity details, so maintainers moved the release up a day, from Thursday to Wednesday. The PHP Foundation called that "the best compromise" between speed, preparation time, and a simple update path.

Embargo, Interrupted

Here's the spicy part. Chainguard published built images containing the fix more than six hours before the coordinated release, and the PHP Foundation says the company "unilaterally broke the embargo." Chainguard's CEO doesn't dispute the timeline but says the company "didn't leak," arguing that "people were getting hit in advance" and that coordinated disclosure holds only "unless there's evidence of active exploits in the wild." Chainguard says its honeypots logged IPs from China and Russia targeting the bugs.

The angle most people will miss: Chainguard's team says it independently rediscovered the same bugs using an AI model in a single night. When AI makes finding a decade-old bug a one-evening job, embargo windows get very short. Patch timelines measured in "whenever we get to it" are officially a liability. And if your PHP comes baked into a container image or a managed host, you're depending on someone else's patch speed, which is exactly why this fight got so heated.

Whoever you side with in the disclosure fight, the advice is the same. As Wiz put it: "Immediate patching is strongly advised."

Drupal, WordPress, and most of the CMS world run on PHP, so if you're not sure which PHP build your sites are actually running (or who's on the hook for patching it), our team can help you find out fast.

Source: The Register