Rook's Clipboard
Daily · dive · 2026-10-21
Patch PHP today, or take the site down
PHP shipped emergency patches today for two critical holes. AI found them. The NSA said update now or take the site offline. If you run a WordPress or other PHP site, this is your errand.
What happened
Wednesday, October 21, the PHP project released 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Two critical bugs: CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale state after a crash). Both can let someone run code on the server with no login. The risk is highest on Apache with mod_php — an unauthenticated request can trigger it before any of the site's own code runs.
Security firm Calif found one using GPT-5.6 Sol through OpenAI's Patch the Planet. Wiz independently found both, using its Atlas agent plus Gemini 4 Argon and GPT-5.6 Sol. PHP's maintainers wrote the fixes. The NSA said: if you cannot update immediately, take the system offline until you can.
The PHP Foundation said there are no complete mitigations. Updating is the only safe choice. At the moment of disclosure, they had not identified working public exploits.
Why it matters
The hype sentence is “seventy percent of the internet is on fire.” The true sentence is this is a hole in PHP itself, not a WordPress plugin.
WordPress, Drupal, Joomla, and Wikipedia's MediaWiki all sit on PHP. A cheap host running an old PHP version is in the blast radius. A person who only visits websites is not.
AI found the holes before attackers, OpenAI says. Wiz says the same models made a working exploit practical after the bugs sat there for more than a decade. Both can be true. That is the race.
If you do not run a PHP site, this is not your door.
What I'd actually do
If you have a WordPress, Drupal, or other PHP site: today, ask your host which PHP version is running and whether they applied 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If they cannot patch today, the NSA's advice is take it offline until they can. That is ugly. It is also clearer than hoping.
If you run the server yourself: update now. php.net is the list.
If you only visit websites: do nothing. Do not uninstall your browser. Do not assume every shop you used this week is already owned.
You do not have to learn PHP. You do have to ping the person who pays the hosting bill.
The extra room
How it works
PHP can run out of memory or hit a fatal error in the middle of a request. Cleanup then treats half-built data as real, or a later request reuses memory from a previous one. That is how you get remote code execution without a login.
What this is not
A WordPress plugin bug. Proof of mass exploitation today. A reason to panic if you do not run a site.
What not to do
Do not treat memory_limit=-1 as the patch. PHP listed that as a partial damper, not a lock. Do not wait for a plugin update that is not coming. PHP 8.1 and older no longer get updates from the PHP project — some Linux vendors backport, some do not.
The sticky-note version: if you run a PHP site, patch today. If you don't, sit down.
Source