Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Briefing for Ash, security researcher · Deeply technical · from the same 70 claims, selected and ordered for one reader

What are the bug classes, what was demonstrated, and what is still open?

This briefing v9 written in site v0.17.0 on 24 October 2026 · history and changes, 8 earlier

The answer in thirty seconds

Two classes: an out-of-memory longjmp leaving request memory uninitialised, and worker global state pointing at freed request memory across requests. mod_php was exploited before application code; FPM for the first flaw is disputed. The fix removes longjmp for OOM. A report of an incomplete fix is open.

Read the site as Ash →

Bug classes, what was demonstrated against what, credits, and the open technical questions.

What to decide or do

Two classes: OOM longjmp leaving request memory uninitialised (CWE-416/755/824/1325/1419), and worker global state pointing at freed request memory across requests.
mod_php exploited pre-application with default limits; FPM via session upload progress for 109619; FPM for 109618 disputed between the GHSA and the Foundation blog.
Credits on both GHSAs: lcfr-hax, sagitzadik-wiz, amyb-oai, tomash-areion. The last is unexplained.
Open: the Fediverse report of a third bug or incomplete fix; Calif's hash pre-image; whether the embedded demo is the deleted video.
The fix changes the engine: soft OOM at a VM safe point, hard OOM via _exit(). Expect behavioural differences under memory pressure.

Your reading path

About 19 minutes in all. Choose read as Ash and the bar under the menu keeps your place on every page.

What this briefing covers

the two bug classes
what was demonstrated against which SAPI
the fix in the code
the open questions

What you can skip

the board line

Words you will meet

Exploit, exploitation mod_php PHP-FPM Out of memory (OOM)longjmp CWE GitHub advisory (GHSA)SAPI Primary source PHP CVSS Vulnerability Remote code execution (RCE)CVE

Each is underlined where it first appears; hover or tap for a one-line definition, or open the glossary.

The facts this rests on

confirmed two or more primary sources agree, or the fact was counted from a captured file
reported one party says so, and it has not been contradicted
disputed the sources disagree, and both readings are shown
contradicted a primary source says otherwise
unverified even the reporting outlet could not check it
p/n primary sources among the n cited; a blocked capture is counted and marked

Claim	Who says it	Status	Fact-check	Primary	Sources
Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fact timeline →	PHP Group (CNA), GitHub advisories, php.net	confirmed	A6 Established	5/5	CVE record CVE record PHP PHP php.net
Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any application code runs fact timeline →	PHP security team (GHSA, oss-security), php.net	confirmed	A6 Established	3/3	PHP oss-security php.net
The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the next VM safe point and a hard OOM via _exit(); the changelog line is 'Avoid state corruption via bailout' fact timeline →	PHP security team	confirmed	A6 Established	3/3	PHP php.net php-src
Updating is the only complete mitigation; the configuration measures reduce exposure to specific paths and do not make an installation safe fact timeline →	php.net; PHP security team	confirmed	A6 Established	3/3	php.net oss-security PHP
Triggering the bug is much easier than turning it into code execution; the CVSS vector says attack complexity high Fastly: 'most deployments may be safe from RCE. Do not assume this holds true for you.' Imperva: five demonstrated techniques, three via session upload progress; about 67 KB of memory disclosed per attack. fact timeline →	Imperva; Fastly; the CVE record	confirmed	A3 Echoed opinion status overstated	3/3	Imperva Threat Research Fastly CVE record
Both bugs are in the C engine, not in PHP code: the allocator's longjmp-based bailout on out-of-memory, and request globals that survive a failed request The fix replaces bailout with a delayed error and an UnwindExit at a safe point, adds a hard limit that _exits, and resets the globals. See the code page. fact timeline →	php/php-src fix commit; the GitHub advisories	confirmed	A6 Established	3/3	php/php-src, read from a clone PHP PHP
In researchers' own tests, pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS Two researcher parties, no third-party reproduction in the vault. The demo videos were not downloaded. fact timeline →	Calif; Wiz for WordPress and Drupal	reported	A2 Reported	2/2	Calif Wiz
None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechanism; a lab reproduction of the leaked PoC's precondition produced a clean 200 The Hacker News says the same of the public code. Fastly: working RCE needs knowledge of the running binary's layout on x86_64. fact timeline →	rjmendez (detection author) citing VulnCheck; Huntress	reported	A1 Weak signal status overstated	1/2	rjmendez, GitHub Huntress
Patching the demonstrated paths does not make the bailout mechanism safe; more paths should be expected A position, from a vendor; consistent with the Fediverse report of a third bug. fact timeline →	Fastly	reported	A2 Reported opinion	1/2	Fastly oss-security
Remote code execution is confirmed on PHP-FPM GHSA-w8hw (CVE-2026-109618): 'no complete FPM exploit has been demonstrated for this SAPI'. The Foundation blog: RCE 'was also confirmed on PHP-FPM through application-level code paths'. GHSA-6wmf (CVE-2026-109619): session lifecycle RCE 'validated against mod_php and FPM'. The accounts may refer to different CVEs. fact timeline →	PHP Foundation blog; GHSA-6wmf for the session path	disputed	A6 Established	4/4	PHP Foundation PHP PHP oss-security
All PHP versions from 5 onwards are affected by at least one of the flaws The CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1. fact timeline →	NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1)	disputed	A3 Echoed disputed	3/4	NCSC-NL Wiz on X CERT-FR oss-security
A web application firewall may provide some protection until systems are patched Swiss BACS: 'Even a web application firewall alone is not sufficient.' Cloudflare says its rules blocked the traffic it saw and that attackers mutated payloads to get past them. fact timeline →	CISA	disputed	A6 Established	3/3	CISA BACS Cloudflare
The flaws are CVSS 10.0 The PHP Foundation: 'a wrong CVSS score of 10.0 (the actual score is 9.2)'. Daubois traces it to a social post relayed by Phoenix Security and to watchTowr via Cyber Daily. fact timeline →	social posts on 20 October, relayed by a vendor and a news site	contradicted	refuted contradicted	1/2	PHP Foundation Daubois
The 8.5.12 fix may be incomplete, or there is a third, different bug Per a Matrix channel, Canonical asked PHP and 'was told that it's unrelated and not a real issue'. Second-hand. Nothing from PHP on the list at capture. fact timeline →	Fediverse posts relayed to oss-security by Aaron Rainbolt and Yves-Alexis Perez	unverified	A1 Weak signal opinion disputed	0/1	oss-security
Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 11 August The hash tweet is dated 5 August 2026 on X; its pre-image has not been published, so what it commits to cannot be checked. fact timeline →	Calif; PHP Foundation (report date)	confirmed	A3 Echoed opinion measures differently status overstated	3/3	Calif Ryan Austin, Calif on X PHP Foundation
The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-oai (OpenAI) and tomash-areion tomash-areion is not named in the PHP Foundation's thanks and appears nowhere else on this beat. fact timeline →	GitHub security advisories	confirmed	A6 Established	2/3	PHP PHP Daubois
The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed Two parties agree. The Foundation calls the delay 'a structural failure'. Cloudflare lists Quarkslab among the 2026 disclosers; nobody else does. fact timeline →	PHP Foundation; Calif	confirmed	A2 Reported disputed status overstated	2/2	PHP Foundation Calif
The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet initiative All three research parties say AI was used. Calif: 'No special harness, or access to models that weren't generally available to everyone were used'. Calif does not name a model; Wiz names Gemini 4 Argon, GPT-5.6 Sol and Wiz Atlas; OpenAI's blog reportedly names GPT-5.6 Sol but is blocked. fact timeline →	BBC; OpenAI; Calif; Wiz	reported	A3 Echoed opinion measures differently	3/4	BBC News OpenAI on X Calif Wiz
OpenAI independently reported the same root cause on 11 August, with further vectors on 18 September The GitHub advisories credit amyb-oai among four reporters. OpenAI's own post credits Calif's discovery 'using GPT-5.6 Sol' and Wiz; an X Community Note disputes OpenAI's role. fact timeline →	PHP Foundation	reported	A2 Reported disputed	2/2	PHP Foundation PHP
Wiz Research independently discovered the first flaw on 19 August and reported on 24 August Wiz's X post says 'Wiz Research uncovers' with no credit to Calif or OpenAI; the blog thanks both. fact timeline →	Wiz; PHP Foundation (24 August)	reported	A2 Reported	2/2	Wiz PHP Foundation
The most severe flaws ever detected by AI Wiz's own wording is 'among the most severe vulnerabilities discovered in PHP, and arguably in software history'. OpenAI: 'one of the most impactful vulnerabilities in recent memory'. fact timeline →	BBC attributing Wiz	reported	A2 Reported opinion measures differently	1/2	BBC News Wiz
Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory finding The Foundation says the OOM signs were found while fixing one of the audit's findings, not in the audit report itself. fact timeline →	Quarkslab's blog; a Substack analysis	reported	A6 Established	1/2	Quarkslab David Lopez-Kurtz
Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before Unverified by anyone else. fact timeline →	Dan Lorenc, via The Register	reported	A2 Reported	0/1	The Register
Frontier AI found the flaw ahead of attackers, giving defenders time to prepare Amazon reports an exploit attempt against a honeypot on 17 October, four days before disclosure, from an actor whose source of exploit information is unknown. fact timeline →	OpenAI	disputed	A2 Reported opinion disputed	1/2	OpenAI on X THN
The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October. fact timeline →	PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release')	confirmed	A4 Corroborated measures differently status overstated	4/4	PHP Foundation oss-security Wiz on X php.net
On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked Primary party. The Foundation does not say who or where. fact timeline →	PHP Foundation	reported	A4 Corroborated disputed	2/2	PHP Foundation PHP Foundation
The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault. fact timeline →	Alexandre Daubois (PHP security team, personal blog)	reported	A4 Corroborated disputed	0/1	Daubois
watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release fact timeline →	Daubois; CERT-EU lists a watchTowr X post among public reports	reported	A4 Corroborated	1/2	Daubois CERT-EU
Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs' Calif's own page does not mention a leak or a deleted video; it embeds two demo videos. Whether one of them is the deleted video is unknown. fact timeline →	PHP Foundation	reported	A3 Echoed	3/4	PHP Foundation PHP Foundation BBC News Calif
Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leaked fact timeline →	PHP Foundation	reported	A2 Reported	1/1	PHP Foundation
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. fact timeline →	PHP Foundation; Chainguard's CEO accepts the time and denies leaking	disputed	A2 Reported opinion disputed	1/3	PHP Foundation The Register Feross Aboukhadijeh on X on X

What is still open

Who first leaked the CVE IDs on 20 October, and where. The PHP Foundation does not say; a PHP security team member points to an anonymous Hacker News post, and Notebookcheck and Nguoi Quan Sat repeat that account. No copy of the post is in the vault.
Whether the deleted Calif video is the one now embedded on Calif's own write-up. Calif's page does not mention the leak.
Whether any site was actually compromised before it was patched or taken offline. Every claim of exploitation so far is of attempts, probes or honeypot hits, and the named cases do not state php2shell as the cause. Authorities in Singapore and Luxembourg now ask operators to look for traces; the answer will come from those searches, if it comes.
Which sites were really taken offline, and why. The list now draws on more captured reports (Germany's hospitals and hosts, Morocco, Romania, Japan), but most are press accounts; few come from the organisations themselves (the Dutch government, Latvia's agency, Weird Gloop, the Charité's spokesman as quoted). A community tracker counts 51 listed and 50 back.
Whether the 8.5.12 fix is complete. A Fediverse report of a third bug or incomplete fix reached oss-security on 21 October; PHP reportedly told Canonical it is unrelated. On 23 October PHP published an informational advisory for a separate flaw, CVE-2026-115560, in the session upload progress feature, reported by Cloudflare, SOCRadar and The Hacker News: it affects fully patched releases including 8.5.12, needs a rare session setting, will be fixed in the next regular release, and has session.upload_progress.enabled=0 as the mitigation; SOCRadar reports no exploitation and no severity score. PHP's advisory is not in the evidence vault, and whether this is the bug the Fediverse report described is not stated.

The full set of claims is on every claim; the ordered steps for a vulnerable system are on if you run PHP. Other readers: Curious reader · Website owner · Project or programme manager · Board member or executive · Security lead · PHP or platform engineer · Journalist · Analyst or policy advisor · CISO · CTO · CFO · Data protection officer · Head of AppSec · Developer · Communications team.