Two critical vulnerabilities threaten global internet security

Two vulnerabilities with critical severity

The two vulnerabilities carry the identifiers CVE-2026-109618 and CVE-2026-109619, and have received a severity rating of 9.2 out of 10 according to the Common Vulnerability Scoring System (CVSS).

The first vulnerability relates to a flaw in handling out-of-memory conditions, which may lead to internal data corruption during request processing. The second is linked to the persistence of data or internal state after freeing used memory, which may allow for the handling of old information during subsequent request processing.

These errors may, under specific circumstances, allow attackers to execute code on the server and access some of its resources or manipulate applications and data, depending on the nature of the system, its privileges, and security settings.

The discovery of the two vulnerabilities does not mean that all sites using PHP have been compromised, but systems that have not applied the fixes remain exposed to increasing risks, especially those directly connected to the internet.

Urgent updates and security warnings

The PHP project released patched versions to address the flaw, including PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, calling on users to install the appropriate updates for their versions as soon as possible.

Cybersecurity specialized entities warned of the emergence of technical information and prototypes demonstrating how to exploit the two vulnerabilities, which could make it easier for attackers to develop attacks targeting servers that have not yet been updated.

The concerned entities recommended that institutions install the fixes immediately and isolate vulnerable systems from the internet temporarily if they cannot be updated, until they are confirmed to be secured.

They also stressed the necessity of monitoring server and application logs for any unusual activity and verifying the possibility of previous exploitation attempts, as installing the update alone does not guarantee the detection of any breach that may have occurred before its application.

Conversely, the availability of a proof-of-concept for exploitation does not necessarily mean that actual attacks have occurred. The Canadian Centre for Cyber Security noted in a warning issued on October 21 the availability of open-source information regarding the possibility of exploiting one of the vulnerabilities, without observing active exploitation at the time the warning was published, while cautioning that the situation could change rapidly.

Why do the two vulnerabilities threaten many sites?

The danger of the incident lies in the widespread use of the PHP language, which is used to power a large percentage of internet sites, in addition to the reliance of content management and e-commerce systems on it, such as WordPress, Drupal, Joomla, and Magento.

According to estimates cited by Reuters from the W3Techs platform, which specializes in web technologies, PHP runs on about 75% of websites where the programming language used could be identified.

This prevalence means that a flaw in a core software component could affect a large number of sites and institutions, especially if they rely on unupdated versions or operating settings that make them vulnerable to exploitation.

Reports indicated that precautionary measures included government sites and services in a number of European countries, where some services were temporarily suspended until the integrity of the systems was verified and the required updates were applied.

Reports also indicated that preventive measures were taken in some systems linked to the Wikimedia Foundation and the Internet Archive, as part of efforts aimed at reducing potential risks.

However, the actual impact depends on the version of PHP used, how it is operated, the speed of applying patches, and the level of protection adopted by each institution.

Artificial intelligence helps in detecting vulnerabilities

Artificial intelligence has emerged in this issue as a tool that helped researchers discover security errors that had remained hidden in the source code for years.

According to reports, the company Calif used the GPT-5.6 Sol model to discover one of the two vulnerabilities, as part of efforts aimed at finding and addressing security issues before they are publicly disclosed.

The cybersecurity company affiliated with Google also announced the discovery of the vulnerabilities independently, using specialized research tools and artificial intelligence models, including Gemini 4 Argon and GPT-5.6 Sol.

These tools, according to published technical analyses, helped in studying complex source code and linking multiple errors together, which allowed researchers to identify potential operational paths for exploiting the vulnerabilities.

The incident demonstrates that the role of artificial intelligence is not limited to accelerating software analysis, but can also help in discovering errors that are difficult to identify by traditional means. At the same time, these capabilities raise concerns about the possibility of using them to develop attack methods if technical details reach malicious parties.

An old flaw that modern tools have re-exposed as dangerous

One of the most prominent aspects of the issue is that the signs of one of the two vulnerabilities date back to 2024, according to what Reuters reported from the PHP Foundation.

The flaw was known theoretically, but researchers at the time were unable to identify a clear way to turn it into a practical attack, while other issues with confirmed impacts were given higher priority for resolution.

Recent developments in analysis tools and artificial intelligence have reopened the door to studying these errors and linking them to operating conditions that might make their exploitation possible.

This incident highlights the difference between discovering a software error and proving that it can actually be exploited; a flaw may remain for years without its risks being fully understood, before new techniques lead to the discovery of previously unknown exploitation paths.

How can risks be reduced?

The first step for institutions is to identify all servers and applications that use PHP, verify their versions and compare them with the patched versions, and then install the appropriate security updates.

Unprotected systems should also be isolated from the internet if they cannot be updated immediately, security logs should be reviewed for unusual activity, and the possibility of breaches occurring before the installation of patches should be verified.

As for users of hosting services and managed platforms, they must ensure that service providers have addressed the flaw in the infrastructure they manage.

The incident reveals a growing challenge in internet security, which is the expanding ability of artificial intelligence tools to discover and analyze vulnerabilities, in parallel with the possibility of their use to develop more sophisticated exploitation methods.

In light of the widespread use of the PHP language, the speed of applying updates and monitoring systems becomes a decisive factor in reducing risks, as protection does not stop at discovering vulnerabilities and issuing fixes, but also depends on them reaching actual servers before attackers exploit the delay in their application.