PHP's two critical RCE fixes: the bug wasn't new, the decision was stuck

The PHP project released emergency patches on October 21, 2026 for two critical remote-code-execution flaws in the language runtime, with the PHP Foundation attributing the long delay to a "structural failure" in decision-making rather than a newly discovered bug. The Foundation said signs of the out-of-memory issue surfaced in 2024, but competing fixes each carried trade-offs — broken compatibility, new denial-of-service risk, or changes to many third-party extensions — and the team "struggled to choose." OpenAI said its GPT-5.6 Sol model assisted researchers in proving impact, while Amazon Threat Intelligence reportedly observed an exploitation attempt on October 17; fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

On October 21, 2026 the PHP project shipped emergency releases for two critical remote-code-execution bugs in the language runtime itself. The headline most outlets chose is "AI found it". The more useful part is what the PHP Foundation says about why it took so long to fix. PHP sits in WordPress, Laravel and a great many business sites. The Foundation says one of the bugs could be triggered on Apache with mod php before any application code runs, so a perfectly written app is still exposed. Amazon Threat Intelligence reportedly saw an exploitation attempt on October 17, per Tenable https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote . OpenAI says its GPT-5.6 Sol model helped the researchers, in its disclosure post https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ . 1. The bug was not new, the decision was stuck. The Foundation writes that the first signs of the out-of-memory problem were found in 2024. Several fixes existed, each with a trade-off: broken compatibility, new denial-of-service risk, or changes to many third-party extensions. The team "struggled to choose" and calls the delay "a structural failure". AI did not find a hidden bug here; it proved the impact, which forced the decision. 2. The fix is the hard part, and it is still human. The Foundation says tools find bugs faster for defenders and attackers alike, and that a person makes every call and works on every patch. Reports are rising: 15 CVEs since July 1 and more than 100 invalid or duplicate reports. 3. Your version is probably not the one you think. The risk sits in containers, base images, shared hosting and old agency builds, not only in the server you patched last. My read, not a fact: expect more AI-assisted disclosures to land on long-standing, "known but hard" bugs, because proof of impact is now cheap. Maintainer time and funding will matter more than detection. php -v on the host docker run --rm IMAGE php -v inside each image you ship Confirm you are on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, then rebuild images that pin an older tag. If you run 8.1 or older, plan the upgrade; do not rely on the backport branches as a long-term answer. Written with AI assistance and checked against the sources above.