PHP 5.4+ flaws: public exploits emerge for two critical engine bugs

• Two PHP engine bugs enable unauthenticated remote code execution on vulnerable versions dating back to PHP 5.4, according to Vercel's advisory.
• Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, as Vercel confirmed. Application and plugin updates do not repair the runtime.
• Exploitation attempts are already reaching firewalls: Vercel's traffic report documents blocked requests, while its advisory confirms working public exploits.
• AI-assisted discovery led to a two-month response involving maintainers and infrastructure providers, according to OpenAI's announcement.

The Calif write-up explains why Apache can reuse a poisoned worker while PHP-FPM terminates it on the same startup failure. The PHP Foundation's account traces the OOM problem to 2024 and describes a leaked demonstration video that disrupted disclosure. OpenAI's Codex checker reads version headers rather than testing whether a server actually contains the fix.

PHP disclosed php2shell on October 21. Both vulnerabilities carry a CVSS v4.0 score of 9.2 and sit in the interpreter's memory management and error handling.

The PHP security advisory distinguishes two failure modes:

• CVE-2026-109618, OOM corruption: an out-of-memory failure interrupts initialization. Cleanup subsequently treats partially initialized internal request data as valid.
• CVE-2026-109619, stale global state: request-owned state survives after its backing memory is freed. A later request handled by the same worker consumes the dangling state before normal initialization resets it.

PHP identifies all installations serving web requests as affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Exploitability varies with version, configuration and application behavior.

Wiz's technical breakdown describes four demonstrated mechanisms grouped under those CVEs:

1. Upload-progress unserializer use-after-free: unauthenticated RCE against WordPress, Drupal and Joomla.
2. Remote process-memory disclosure: sensitive worker memory exposed without achieving RCE.
3. Fatal-error backtrace use-after-free: unauthenticated RCE against Drupal.
4. OPcache type confusion: corrupted shared state enabling unauthenticated RCE against WordPress.

The memory-disclosure path can expose passwords, tokens and API keys belonging to other requests or the server itself.

PHP considers mod_php the highest-risk deployment because a demonstrated attack runs before application code executes. Calif's worker-lifecycle analysis explains the difference:

• Apache mod_php: failed request startup still reaches request cleanup. The heap is freed, but the worker can survive with dangling Session globals and process another request.
• PHP-FPM: the same startup failure terminates the worker. Fatal errors after successful startup can still follow normal request shutdown and leave exploitable state for another request.

That distinction blocks particular startup paths on FPM, while other demonstrated chains still reach FPM deployments.

Calif also demonstrated a request below the default 8 MiB POST limit exhausting the default 128 MiB PHP heap through nested empty-upload records. A small HTTP body can produce much larger internal allocations.

The fixed upstream releases are:

| Branch | Fixed release |
| --- | --- |
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |

PHP 8.1 and earlier no longer receive regular upstream updates. The PHP team nevertheless supplied minimal source backports for 7.4, 8.0 and 8.1; distributions and LTS vendors may provide their own patched packages.

The maintainers' advisory describes configuration changes as partial protections, with important limits:

• memory_limit=-1: removes the controllable PHP memory-limit failure, but underlying allocation failures can still reach vulnerable code.
• Request-size and complexity limits: cover decoded bodies, field counts, multipart parts and nesting, including requests without a usable Content-Length.
• session.upload_progress.enabled=0: blocks confirmed Session paths when applied before request parsing and followed by worker restarts. ini_set() and FPM .user.ini are too late.
• fatal_error_backtraces=0: blocks the confirmed backtrace path on PHP 8.5 only.

PHP explicitly says hiding diagnostics with error_reporting, display_errors or @ does not help. The NSA also listed taking systems offline as an option when immediate mitigation is infeasible.

PHP's public advance notice scheduled release for October 21 at 14:00 UTC and reserved the right to release earlier if details or exploitation emerged.

The foundation's subsequent account supplies the missing chronology:

• October 20, around 15:00 UTC: CVE IDs circulated with an incorrect release time and an incorrect 10.0 severity score. No technical details accompanied that initial leak.
• October 20, 19:30 UTC: PHP brought forward its pre-announcement and moved the release from October 22 to October 21. Distributors were still packaging fixes.
• Around 20:00 UTC: Calif mistakenly published a demonstration video. Copies circulated after deletion, exposing additional clues and accelerating PoC development.
• October 21, 07:41 UTC: Chainguard published patched images more than six hours before coordinated release. The foundation called this an embargo breach.

Someone involved in the early image release said on Hacker News that they acted after exploits appeared in the wild. The foundation says maintainers inspected circulating PoCs but had not identified a functional exploit at release time.

By its October 21 bulletin, Vercel was reporting working public exploits. Its WAF rules had shipped before disclosure and apply automatically, at no cost, to all Vercel projects.

Coverage includes PHP functions on Vercel and requests proxied or rewritten to external PHP backends. Direct requests that bypass Vercel's network remain outside that protection.

Vercel credited an industry Slack channel for the coordination and said its mitigations had already prevented attempts against PHP origins.

Cloudflare CEO Matthew Prince reported a much larger escalation across its network:

Those observations count attempts, not successful compromises. AI involvement in the PHP2Shell attack traffic was not established.

Calif used GPT-5.6 Sol, the model steipete highlighted when the vulnerability became public. OpenAI's disclosure account credits Calif with identifying one critical flaw and Wiz with independently discovering and reporting both vulnerabilities.

Wiz used three systems during its research:

• Wiz Atlas
• Gemini 4 Argon
• GPT-5.6 Sol

The speed-up was unnerving: according to Wiz's researchers, one researcher completed in a week work that previously would have taken a world-class team months. Models helped adapt working exploits across applications in hours by iterating through version differences, memory layouts, failed attempts and debugging.

OpenAI also described internal work on patching and detection alongside discovery.

The OOM problem had already surfaced in 2024, as rohanpaul_ai reported. The PHP Foundation's account gives a more specific history: a foundation-contracted core developer noticed it while fixing an issue from the Quarkslab audit, but no concrete exploitation vector was established then.

Competing fixes carried different costs:

• Backward-compatibility breaks
• New denial-of-service risks
• Changes across third-party extensions

The foundation called the repeated stalls a “structural failure” involving consensus-based decision-making and insufficient resources. Reports from Calif and OpenAI on August 11 established the impact and made the fix the security team's top priority.

Report triage was another constraint. Since July 1, the team had published 15 CVEs and processed more than 100 invalid, duplicate or unreproducible reports; AI helped validate and group submissions, but humans made every decision and worked on every patch.

OpenAI packaged two Codex skills for checking a URL or a server-side PHP installation.

The repository also exposes a direct CLI:

Its result contract is:

• OK, exit 0: a stable version above the embedded vulnerable cutoff for a recognized branch.
• VULNERABLE, exit 1: a version at or below that cutoff.
• UNKNOWN, exit 3: missing version information, an unrecognized branch or certain prerelease builds.

The URL check reads X-Powered-By and Server, sends HEAD, and falls back to GET only after a 405 or 501 response. It neither follows redirects nor inspects response bodies.

OK is a version comparison, not independent confirmation of the security fix. Headers can be changed, distribution backports may retain older upstream version strings, and --local examines CLI PHP rather than independently identifying the runtime serving web traffic.

PHP maintainers led the fixes and release. OpenAI described a major PHP engine change supported by roughly two months of coordination across researchers, infrastructure providers and governments.

OpenAI's proposed response framework has five stages:

1. Validate and fix upstream: confirm impact, develop the fix and adversarially test patches with frontier models.
2. Give affected organizations preparation time: coordinate backports, hosting mitigations, detection and WAF rules.
3. Coordinate with governments: extend guidance to critical infrastructure and essential services.
4. Prepare downstream updates: involve additional distributors, service providers and operators as the fix stabilizes.
5. Publish guidance and support deployment: continue responding as operators install updates and identify coverage gaps.

The company also asked whether operators should ever use a vulnerability to patch systems they own or are authorized to manage after losing administrative access. Its consultation raises safeguards for that scenario alongside disclosure timing, advance notice and secure-by-default packages.