AI is forcing us to pay off 40 years of technical debt

IEEE Spectrum reports that a PHP out-of-memory crash, first reported to the PHP Foundation in 2024, later became a route to remote code execution. The two flaws, CVE-2026-109618 and CVE-2026-109619, are nicknamed PHP2Shell and can let an unauthenticated attacker run code on a server or read process memory. A researcher at the security firm Calif used an AI assistant during an OpenAI-sponsored audit of PHP and, according to Spectrum, reached a working exploit path in about two weeks. Wiz, a Google-owned cloud security company, found the same bugs separately in August.

The flaws sit in PHP's own runtime, so application code can be sound while the server remains exposed. When memory runs out, PHP aborts request processing through an internal jump, and that path can leave a pointer to freed memory. A later lookup can then read attacker-controlled data as internal PHP structures. The second flaw involves stale global state that carries over between requests. Qualys rates each CVE at 9.2 under CVSS v4.0. Spectrum says the exposure reached sites run by NASA, Wikipedia and the White House, along with the many WordPress and Drupal sites that rely on PHP. Imperva believes affected releases go back to PHP 5.4.0.

PHP released fixes on October 21, 2026, in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Per Spectrum as relayed by StartupHub.ai, four PHP Foundation engineers spent two months building a patch that closes every attack path without breaking existing functionality. Reports on exploitation conflict. Amazon Threat Intelligence says it saw an attempt dating to October 17, four days before disclosure, while CISA said it had not observed exploitation as of October 21.