PHP releases security updates for two reported unauthenticated server takeover vulnerabilities

What happened

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to patch CVE-2026-109618 and CVE-2026-109619, according to Baoyu, who describes the flaws as enabling server takeover without authentication and says researchers call them PHP2Shell. In the quoted post, OpenAI says its models helped researchers discover critical PHP security flaws through its Patch the Planet initiative.

Reported by 2 sources

The story so far

PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to patch two security vulnerabilities, according to Baoyu, who linked the updates to flaws OpenAI said its models helped researchers discover through its Patch the Planet initiative. Baoyu identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, described them as allowing server takeover without authentication, and said researchers call them PHP2Shell. OpenAI introduced Patch the Planet to connect security researchers, software maintainers, and incident responders working to address critical vulnerabilities in open-source software. The company described the PHP flaws as critical and estimated that PHP, an open-source programming language, is used to run 70% of websites.

Keep reading

Trending now

1. 1Mistral and NVIDIA Announce Industrial Engineering AI Collaboration and Open Benchmarks
2. 2Mistral Releases Voxtral 3 Speech Models, Voice Agents API and LiveKit-Based SDK
3. 4DeepSeek Open-Sources DeepInfer and API Components, With Model and Hardware Limits
4. 5OpenAI Acquires Orchestra Bio to Add Drug Development Operations to Its Life Sciences Tools