October 24, 2026

CVE-2026-109618 in PHP: a bug found with AI opens remote code execution

Two PHP vulnerabilities allow remote code execution without logging in: CVSS v4.0 score 9.2 out of 10. Fixes shipped on Oct 21, 2026, in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Source

theguardian.com · theguardian.com ↗

story · 3 stories — how events unfolded

Insight
GPT-5.6 Sol helped find critical flaws in PHP, which runs about 70% of websitesOctober 21
News
PHP2Shell: flaw in PHP versions from 5.4 already exploited in attacks on websitesOctober 22

All news

One email a week - only what changes how you work. Subscribe

News

October 24, 2026

CVE-2026-109618 in PHP: a bug found with AI opens remote code execution

Two PHP vulnerabilities allow remote code execution without logging in: CVSS v4.0 score 9.2 out of 10. Fixes shipped on Oct 21, 2026, in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Source

theguardian.com · theguardian.com ↗

story · 3 stories — how events unfolded

Insight
GPT-5.6 Sol helped find critical flaws in PHP, which runs about 70% of websitesOctober 21
News
PHP2Shell: flaw in PHP versions from 5.4 already exploited in attacks on websitesOctober 22

All news

One email a week - only what changes how you work. Subscribe