The Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 21 warned organizations about critical vulnerabilities in the widely used PHP programming language that could allow attackers to remotely execute malicious code on vulnerable servers without authentication.
Also today, PHP developers released security updates addressing the two vulnerabilities – CVE-2026-109618 and CVE-2026-109619, which each carry a severity score of 9.2 out of 10. The flaws pose risks to internet-facing applications and potentially to federal agencies and contractors that rely on PHP-based systems.
The vulnerabilities affect multiple supported versions of PHP, an open-source programming language widely used to power websites and web applications. According to an Oct. 21 advisory from the European Union’s Computer Emergency Response Team (CERT-EU), attackers could exploit either flaw to execute code remotely without needing valid login credentials.
The fixes issued today address PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Organizations running earlier versions should update their installations immediately, the advisory said.
CERT-EU also warned that technical details and initial proof-of-concept exploits have begun circulating publicly, increasing the risk that attackers could exploit vulnerable systems.
For federal IT leaders, the vulnerabilities raise concerns beyond directly managed web servers. Commercial and open-source software products that incorporate PHP may also be affected, requiring agencies to coordinate with software suppliers, hosting providers, and contractors to identify vulnerable systems and confirm that patches have been deployed.
The security response also highlights the growing role of artificial intelligence (AI) in identifying software vulnerabilities.
In an Oct. 21 announcement, OpenAI said its Patch the Planet initiative helped coordinate a response to the PHP vulnerabilities over the past two months, working with software maintainers, security researchers, technology providers, and government agencies.
OpenAI said a researcher identified a critical PHP flaw using GPT-5.6 Sol, while cybersecurity company Wiz independently discovered and reported both vulnerabilities.
PHP maintainers led the development and release of the fixes, and OpenAI and partners including Wiz and Cloudflare provided technical research, testing, and coordination to help prepare protections before the vulnerabilities were publicly disclosed.
OpenAI said it worked with its partners to engage several U.S. government organizations, including the White House’s Super Intelligence Force, the Office of the National Cyber Director, and CISA, as well as international partners, to support the coordinated response.
OpenAI said the coordinated effort demonstrates both the defensive potential and security risks associated with increasingly capable AI systems. While advanced models can help researchers identify vulnerabilities before attackers exploit them, those same capabilities could also accelerate the development of malicious tools.
The company is proposing a broader coordinated disclosure framework that would bring together software maintainers, AI developers, cybersecurity providers, and government agencies to validate vulnerabilities, develop fixes, prepare protective measures, and distribute security guidance.
OpenAI also announced that it has committed $1 billion in subsidized access to its Daybreak cybersecurity capabilities through an initiative focused on organizations with limited security resources to protect essential services.
Meanwhile, CERT-EU said organizations unable to patch immediately should consider isolating vulnerable internet-facing applications from public networks until fixes can be applied and verified.