OpenAI, Calif and Wiz disclosed two critical vulnerabilities in the PHP engine on October 21, 2026, with fixes available before attackers could exploit them. Tracked as CVE-2026-109618 and CVE-2026-109619, they each carry a CVSS score of 9.2 and enable remote code execution and malicious memory disclosure without requiring authentication. They affect PHP versions going back to 5.4.0 and could impact an estimated 70% of PHP-reliant websites, including WordPress, Drupal and MediaWiki. The exploit behavior was independently verified on WordPress and Drupal in August 2026, while disclosure was coordinated with AWS, Google Cloud and Microsoft. Website operators must install patched PHP versions to prevent security incidents and consequential financial losses.
Source: Read the original article
