PHP Has Two Critical Vulnerabilities. The NSA's Advice: Patch or Disconnect.

On October 21, 2026, the PHP team released a critical security update: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. They fix two remote code execution (RCE — an attacker's ability to run arbitrary commands on your server) vulnerabilities rated at the practical ceiling of severity: CVSS v4.0 9.2 out of 10. The Drupal patch from October 14 already tested many teams' reflexes. This is a different category of urgency.

This isn't a flaw in a module or a third-party package. It's the language that runs, by figures cited by OpenAI, an estimated 70% of websites. And according to PHP's own advisory, there is no way to fully shield yourself without updating.

What broke, in business terms#

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, share one trait: they let an unauthenticated attacker execute code on your server before your application even processes the request. It doesn't matter how well-written your business logic is, how robust your authentication layer is, or how many security reviews your app has passed. The problem lives below all of that, inside the PHP interpreter itself.

• CVE-2026-109618: memory corruption during out-of-memory handling. Impact is worst on mod_php setups (PHP running embedded directly inside the Apache web server process), and it's triggerable by a single unauthenticated request, before application code runs.
• CVE-2026-109619: stale state from a previous request surviving across requests on the same worker (the process handling requests), letting one user's data contaminate the execution of the next.

The technical advisories are published as GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. The PHP team's own notice was unusually blunt: "there are no complete mitigations, updating is the only safe choice."

Why this time is different: AI on both sides#

These vulnerabilities weren't found through traditional manual code auditing. They were discovered by agentic AI systems acting as security researchers: OpenAI models under its "Patch the Planet" initiative and, independently, Wiz's Wiz Atlas security agent. According to Wiz, the discovery was possible precisely because AI lowered the technical barrier to exploiting flaws that were previously too complex to weaponize manually.

"LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts"

It's the same dynamic we covered when Microsoft warned about AI agents as an insider threat: AI isn't inherently good or bad, it's a capability multiplier — for defenders and attackers alike. OpenAI frames it as a "Defender's Window": to its knowledge, frontier AI found these vulnerabilities before attackers did, opening a window for maintainers and security providers to prepare fixes and protections ahead of disclosure. That window has now closed. The flaw is public, the patch is public, and the race is now against attackers who have access to the same models.

The real-world impact already surfaced outside the pure PHP world: outlets reported government websites in several countries going offline while teams scrambled to patch.

mod_php vs FPM: not all exposure is equal#

The vendor is explicit: the impact of CVE-2026-109618 is worst on mod_php setups, where PHP runs embedded directly in the Apache web server process. In that model, a compromised worker shares memory and context with the web server itself. Installations on PHP-FPM (FastCGI Process Manager, a model where PHP runs in separate processes invoked by the web server) have a different attack surface — not immune, but potentially a more contained blast radius.

For an infrastructure team, this reshuffles patch priority within the same fleet: mod_php servers (common in legacy WordPress installs and older Apache setups) jump to the top of the list, ahead of instances already migrated to FPM with nginx.

Partial mitigations — and why they aren't enough#

PHP's team and the community have documented a few configurations that reduce risk while the patch rolls out, though none close the hole completely:

• session.upload_progress.enabled=0 in php.ini or the FPM pool — reduces the exposed surface in file upload handling.
• fatal_error_backtraces=0 on PHP 8.5 installs — limits information exposed during fatal errors.
• memory_limit=-1 combined with a low post_max_size — avoids certain memory-exhaustion scenarios that trigger the vulnerable condition.
• Avoiding RLIMIT_AS or RLIMIT_DATA as an OS-level memory limit mechanism — these limits can actually favor the corruption scenario the flaw exploits.

The problem nobody wants to name: PHP 8.1 and EOL versions#

Here's the detail that turns this from a technical incident into a governance risk: PHP 8.1 and earlier no longer receive official support, and will only get vendor backports, if any. TechCrunch confirms that sites not running relatively current versions of PHP have extra update work ahead, since older branches are out of support.

A second clock is also running in parallel: PHP 8.2 reaches its own end-of-life on December 31, 2026. Any remediation plan for this crisis that only moves a fleet from 8.1 to 8.2 is solving a 2026 problem by inheriting the same problem ten weeks later.

Drupal, WordPress, and Laravel: exposure isn't the framework's fault#

Worth clarifying for anyone managing a CMS or framework on top of PHP: this isn't a Drupal, WordPress, or Laravel flaw. It's a flaw in the interpreter that runs all of them equally. WordPress issued a statement clarifying the problem isn't CMS-specific, and that sites running it need to patch at the server level and coordinate with their hosting provider. Drupal issued its own alert (PSA-2026-10-20) reinforcing the same message: updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.

This matters because many application teams reasonably assume their stack's security is their hosting provider's or infrastructure team's responsibility. In a crisis like this, that boundary of ownership becomes the exact blind spot where a site stays exposed for weeks.

Auditing an enterprise fleet in 48 hours#

For an organization with multiple web properties, environments, and hosting providers, the question isn't "do we update?" — it's "do we actually know what we're running, and where?" A reasonable audit plan includes:

• Real PHP version inventory across every production, staging, and dev environment — not the documented version, the version php -v actually returns on each server.
• Execution-mode classification: mod_php versus PHP-FPM, given the higher documented impact on mod_php installs.
• Flagging any instance on PHP 8.1 or earlier, which needs a separate, more urgent migration plan rather than just a patch.
• Verifying that AWS Elastic Beanstalk, Docker containers, or custom AMIs use the updated base image, not one frozen before October 21.
• Confirming patch timelines with every hosting provider or CDN, especially where hosting is third-party managed.

Teams already operating with Infrastructure as Code on AWS have a real advantage here: a declarative definition of the base image lets you confirm and roll out the patched version fleet-wide in an auditable way, instead of relying on every server being manually updated.

The risk is no longer technical. It's a board-level one.#

When the NSA publicly recommends disconnecting systems rather than leaving them exposed, the threshold of the conversation changes. This is no longer a ticket in the DevOps queue. It's a decision a risk committee, a CISO, or a board needs to answer precisely: what version of PHP does every digital property run, who owns the update, and how much exposure time is acceptable while it rolls out?

Keeping a critical application on an out-of-support PHP version — common in legacy Drupal or WordPress systems built years ago — is no longer abstract technical debt. It's a quantifiable risk, with a CVSS of 9.2 and a national intelligence agency recommending disconnection. Solving it durably isn't just applying this week's patch: it's having a team with the operational expertise to keep the fleet updated, audited, and off EOL versions on an ongoing basis — exactly the kind of work that separates an emergency patch from infrastructure that doesn't end up back in this position.