Critical PHP Vulnerabilities Exploited Following Early Disclosure and Premature Patch Release

Critical vulnerabilities in PHP, identified as CVE-2026-109618 and CVE-2026-109619, were patched on October 21. Their exploitation in the wild was reported shortly after disclosure, prompting rapid security responses, a situation exacerbated by the early leak of their details and premature release of patches.

The timeline began on October 20, when the CVE numbers for the PHP vulnerabilities started circulating online. This early dissemination occurred alongside a premature release of patch images by Chainguard, more than six hours ahead of the agreed time. The PHP Foundation noted that the initial circulation included an incorrect severity score of 10.0, later corrected to the actual 9.2. A proof-of-concept video was also mistakenly published by Calif.

According to CZ, the vulnerabilities allow attackers to exploit systems without requiring login credentials, meaning that simply visiting a website could potentially lead to credential theft or device compromise. CZ warned internet users to exercise caution when visiting websites in the days following the disclosure. The Binance founder stated that exploitation was reported in the wild soon after disclosure, leading to quick Web Application Firewall (WAF) protections and patching by IT teams.

Cybersecurity agencies issued advisories in response to the reported exploitation. NSA Cyber advised organizations running PHP to prepare for an update or take affected systems offline if immediate patching was not feasible. The FBI’s cyber division echoed the recommendation to take systems offline and urged operators to monitor for unexpected command shell launches originating from PHP processes.

Infrastructure providers also took action. Cloudflare reported that it had activated default firewall protections before the vulnerabilities became public knowledge. For entities within the cryptocurrency space, the response focused on reassuring users about their infrastructure. BNB Chain executive Nina Rong reported that the network does not utilize PHP in its technology stack. Similarly, decentralized exchange PancakeSwap stated that PHP is not used in its infrastructure, and user funds remain safe. CZ commented on PancakeSwap’s statement, suggesting that more projects should provide similar confirmations.

The discovery of these bugs involved artificial intelligence. OpenAI said that its models assisted researchers in identifying the vulnerabilities through its Patch the Planet initiative, describing the bug as “one of the most impactful vulnerabilities in recent memory.” OpenAI added that, to its knowledge, frontier AI systems identified the problem before malicious actors did.

This development intersects with broader discussions about AI’s influence on cybersecurity. Ethereum co-founder Vitalik Buterin has previously suggested that AI advancements could make cybersecurity increasingly challenging, reasoning that AI capable of proving complex mathematical theorems might also be able to suggest program security. However, the exact nature of this reasoning and its implications remain subjects of ongoing discussion.

Several uncertainties persist regarding the full scope of the incident. The precise number of compromised devices or stolen credentials is not yet known. The extent to which websites were affected by these vulnerabilities also remains unclear. Additionally, questions linger about whether functional exploits were discovered before the official release, as noted by the PHP Foundation, and the specific AI techniques employed by OpenAI.

The incident underscores the critical nature of managing vulnerability disclosures and the challenges posed by early information leaks. It also highlights the evolving landscape of cybersecurity, where AI is playing an increasingly significant, albeit dual-edged, role in both identifying and potentially exploiting security flaws.

Why This Matters

The materials describe a narrow update: Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were patched on October 21 after their details leaked early. The exact number of compromised devices or stolen credentials.

Broader Context

Source materials place the factual news in this context: Changpeng Zhao (CZ) is telling internet users to be extra careful on any website for the next few days, after two PHP vulnerabilities were patched on October 21 when their details leaked early.