PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024

The two PHP vulnerabilities causing worldwide alarm first drew serious attention in August after an outside review by AI companies, the PHP Foundation explained in a lengthy statement on Wednesday.

The organization said the history of one bug, CVE-2026-109618, dates back to 2024, when PHP underwent its first external security audit in several years, but officials took no action.

The issue caused controversy within PHP as engineers debated how to address it, with concerns ranging from “backward compatibility breaks, new denial-of-service potential, or requiring changes to many third-party extensions which seemed impossible to coordinate.”

“The PHP security team, operating on consensus, struggled to choose between these and feared the repercussions of shipping the wrong choice,” the nonprofit foundation said. 

“Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine occupied with many responsibilities, this decision process caused work on a fix to stall and restart repeatedly over months.” 

Hundreds of websites were taken offline on Wednesday by companies and governments as a result of CVE-2026-109618 and a related bug, CVE-2026-109619. Some estimates show that more than 70% of all websites on the internet use PHP. Internet infrastructure company Cloudflare reported seeing attempted exploitation. 

The PHP Foundation said both vulnerabilities “sit in parts of PHP that nearly every request touches.”

“Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions,” they said. 

The scope of the vulnerabilities has alarmed cybersecurity defenders and governments, with a VirusTotal analysis showing 5.1 million IP addresses identified as running PHP. At least 758,000 IP addresses were disclosed as end-of-life PHP versions and 85,000 IP addresses were running the latest PHP releases available before developers issued emergency patches Wednesday morning. 

These figures represent PHP's internet-facing footprint, not confirmed vulnerable systems. The patches only apply to versions dating back to PHP 8.2. Every version older than that no longer receives updates from the PHP Project.

Cisco Talos’ released estimates suggesting roughly 50% of vulnerable PHP systems may not receive a patch.

AI spotlights bugs

After deciding against taking any action in 2024, the PHP Foundation was confronted with the issues again with the emergence of powerful AI code review tools. Services from Anthropic and OpenAI were used earlier this year to scan PHP platforms and eventually a researcher at cybersecurity firm Calif reported the bugs on August 11. 

On social media, Calif also credited another researcher with initially discovering the vulnerability and developing an exploit.

OpenAI and security companies Wiz and Trail of Bits also found the same vulnerabilities during audits of PHP. 

The reports “made the full impact of the … problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation's team working on security,” the foundation explained.  

The PHP Foundation said its coordinated disclosure process was running smoothly until rumors of the bugs began to emerge on social media two days ago. They moved up their disclosure of the bugs by one day but argued that they could not have immediately released it because the fix was still being packaged. 

They noted that Calif “mistakenly published a video” that showed their proof of concept working against a number of targets and revealed additional details about the vulnerabilities. That video, even after being deleted, began circulating and “accelerated development” of exploitation proof of concepts (PoCs).

PHP Foundation monitored several of the PoCs that began to circulate online throughout Tuesday evening but did not identify any functional exploits. 

The blog notes that cybersecurity firm Chainguard unilaterally broke the embargo early on Wednesday and published images containing the fix. Chainguard did not respond to requests for comment about the allegations. 

“Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed,” the foundation said. 

“Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.”

The PHP Foundation listed out dozens of changes to its internal structure that would not allow a similar situation to occur again and argued that “a serious vulnerability with a fix stuck on hard trade-offs would now reach the PHP Foundation leadership much sooner.”