OpenAI flags two critical PHP flaws and ships a tool to check exposure

OpenAI has disclosed two critical memory-safety vulnerabilities in PHP, the scripting language that quietly runs a huge share of the web. Both flaws could let an attacker run code on a server without logging in first. What OpenAI found The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Each carries a CVSS severity rating of 9.2, which places it firmly in the critical category. Both bugs are memory-safety issues. In practice, a clever attacker can abuse that sloppiness to slip in instructions of their own. Here, the result is unauthenticated remote code execution. Put simply, a stranger on the internet could potentially take control of an affected server without needing a password. Fixes were released on October 21, 2026. The patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Building those emergency patches took approximately two months. The work involved PHP maintainers collaborating with outside security firms, with PHP leading the disclosure process. A checker tool, not an exploit Alongside the disclosure came a tool called php2shell-checker. It lets site operators assess whether their setup is vulnerable without sending exploit traffic to the ...