PHP Patches Two Critical Flaws as OpenAI Codex Security Gets Credit
Photo: TokenPost
PHP released fixes Oct. 21 for two critical vulnerabilities that can let an unauthenticated attacker execute code remotely, with OpenAI Codex Security among the research efforts credited in the coordinated disclosure. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws involve out-of-memory corruption and stale global state. Both carry a CVSS v4.0 score of 9.2. The bugs affect PHP installations processing web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. A combined exploit was demonstrated against WordPress, Drupal and Joomla, but the vulnerable code is in PHP itself. Administrators can install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Source: TokenPost
