On October 21, 2026 the PHP project shipped emergency releases for two critical remote-code-execution bugs in the language runtime itself. The headline most outlets chose is "AI found it". The more useful part is what the PHP Foundation says about why it took so long to fix.
PHP sits in WordPress, Laravel and a great many business sites. The Foundation says one of the bugs could be triggered on Apache with mod_php before any application code runs, so a perfectly written app is still exposed. Amazon Threat Intelligence reportedly saw an exploitation attempt on October 17, per Tenable. OpenAI says its GPT-5.6 Sol model helped the researchers, in its disclosure post.
1. The bug was not new, the decision was stuck. The Foundation writes that the first signs of the out-of-memory problem were found in 2024. Several fixes existed, each with a trade-off: broken compatibility, new denial-of-service risk, or changes to many third-party extensions. The team "struggled to choose" and calls the delay "a structural failure". AI did not find a hidden bug here; it proved the impact, which forced the decision.
2. The fix is the hard part, and it is still human. The Foundation says tools find bugs faster for defenders and attackers alike, and that a person makes every call and works on every patch. Reports are rising: 15 CVEs since July 1 and more than 100 invalid or duplicate reports.
3. Your version is probably not the one you think. The risk sits in containers, base images, shared hosting and old agency builds, not only in the server you patched last.
My read, not a fact: expect more AI-assisted disclosures to land on long-standing, "known but hard" bugs, because proof of impact is now cheap. Maintainer time and funding will matter more than detection.
php -v # on the host
docker run --rm IMAGE php -v # inside each image you ship
Confirm you are on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, then rebuild images that pin an older tag. If you run 8.1 or older, plan the upgrade; do not rely on the backport branches as a long-term answer.
Written with AI assistance and checked against the sources above.