Two critical PHP flaws found with AI help: update now, and check your version with OpenAI's free Codex skill

On October 21 the PHP project shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, security releases that fix two critical vulnerabilities which, in PHP's words, "can allow unauthenticated remote code execution." PHP's advance notice a day earlier rated both CVSS v4.0 9.2. Its advice is short: "All PHP users are strongly encouraged to update immediately."

What was found. PHP's advisory lists two bugs. CVE-2026-109618 is remote code execution via out-of-memory corruption: running out of memory can interrupt PHP while request data is only half set up, and cleanup then treats the broken data as valid. CVE-2026-109619 is remote code execution via stale global state: internal state from one request can outlive its memory and be used by a later request on the same worker. PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and it rates mod_php highest, with a demonstrated exploit that fires "before any application code runs."

Where AI comes in. OpenAI says Calif found a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet program, and that Wiz also independently found and reported both bugs. PHP's maintainers led the fix and the release; OpenAI says it spent two months coordinating maintainers, researchers and security providers, including Cloudflare, so protections were ready before disclosure. OpenAI calls it "one of the most impactful security issues in recent memory" and says that, to its knowledge, AI found the bugs before attackers did. It also warns that "the same capabilities can also help attackers rapidly develop offensive tools and exploits."

The tool. Alongside the post, OpenAI open-sourced php2shell-checker on GitHub under the Apache 2.0 license: a Node.js script, with no packages to install, packaged as two Codex skills. phpcheck-url checks a website from the outside; phpcheck-server checks the PHP on a machine you control. You can also run it directly with node phpcheck.js "https://example.com" or node phpcheck.js --local. It sends no exploit requests. It answers OK, VULNERABLE or UNKNOWN, by comparing the version it sees with cutoffs embedded in the script. We read those cutoffs: they mark 8.2.34, 8.3.35, 8.4.26 and 8.5.11 and older as vulnerable, which matches PHP's fixed versions, and they also cover older branches back to 5.4.

Who it's for: anyone who runs or hosts PHP sites and wants a quick first pass over which ones report an old version, especially if you already use Codex.

The caveat, from the README. The checker only reads the version a server reports in its X-Powered-By or Server headers, or from php -v. Many servers hide those headers, and then you get UNKNOWN, which, the README says, "does not mean the target is patched." Headers can also be changed, and Linux distributions often backport fixes without changing the version number, so an OK or VULNERABLE is a version comparison, not proof. OpenAI isn't taking outside code contributions to the repo.

What to do. Update to one of the fixed versions, or install your distribution's patched package; PHP says Linux distributions and long-term-support vendors got the patches in advance. PHP 8.1 and older no longer get updates from the PHP project, though PHP's security team published minimal source backports for 7.4, 8.0 and 8.1. If you can't update right away, PHP's advisory lists stopgaps, such as turning off session.upload_progress.enabled and lowering post_max_size, but warns that they "do not make an installation safe." PHP 8.2 reaches end of life on December 31, 2026.

MODEL has not tested php2shell-checker hands-on. Everything above comes from PHP's advisory, OpenAI's post, the GitHub repository and its source code, read on October 21. This is not sponsored and has no affiliate links.