PHP maintainers released emergency security updates on October 21 after researchers disclosed two critical vulnerability groups that can expose server memory or enable remote code execution without authentication. The problems reside in the PHP engine rather than in a particular content-management system, widening their relevance across web applications built on the language.
Wiz Research said the bugs arise when PHP handles fatal conditions, especially out-of-memory failures, while processing a request. In vulnerable configurations, an abnormal termination can leave internal global state corrupted. A later request handled by the same worker may then interact with that stale state, creating a path to memory disclosure or memory corruption. The disclosed instances were grouped as CVE-2026-109618 and CVE-2026-109619, with severity reaching 9.2 under CVSS 4.0.
The research team demonstrated pre-authentication code execution against deployments of WordPress, Drupal and Joomla. Those applications were representative targets, not the source of the defects. Wiz said even a minimal PHP application can be affected because exploitation acts on the runtime underneath application code. Separate demonstrations extracted process memory that could contain credentials, authentication tokens, API keys or certificates from other requests.
Exposure varies by PHP version, server interface, configuration and application behavior. The researchers said at least one vulnerability reaches back to PHP 5.4, leaving releases from more than a decade of development potentially affected. Building a reliable exploit required chaining several behaviors and adapting to differences in memory layout, so a technique that works against one deployment may need changes for another.
Wiz said frontier AI models materially accelerated that adaptation and helped turn long-standing memory-safety weaknesses into practical exploit chains. That claim matters operationally because complexity has often been treated as a partial barrier to exploitation. Tools that can assist repeated debugging and layout-specific adjustments may reduce the time and specialist effort attackers need after technical details become available.
The patches address the faulty state-management behavior at the engine level rather than merely blocking the specific demonstrations. Administrators should therefore install the fixed PHP release for their maintained branch instead of relying on application updates alone. The official guidance says an update is the only complete remedy. Controls at content-delivery networks or web application firewalls may reduce some attack paths but cannot cover every vulnerable configuration.
Teams should first identify every place PHP processes web requests, including conventional websites, APIs, administrative tools and overlooked internal services. Container images and serverless build artifacts need rebuilding with patched packages, while fleets should be checked for workers that remained alive through an update. Unsupported PHP branches require migration to a maintained release rather than waiting for a backport.
Because memory disclosure may reveal reusable secrets, organizations should also review monitoring for suspicious request patterns and be prepared to rotate high-value credentials where exposure is suspected. The immediate priority, however, is direct: deploy the October 21 fixes throughout the PHP estate.
