A day after vulnerabilities were discovered in the PHP programming language, prompting an urgent response from governments and cybersecurity agencies worldwide, the PHP team released fixes for two critical remote code execution (RCE) vulnerabilities. The team urged users to update their systems immediately.On Wednesday, October 21, governments and cybersecurity agencies warned website operators about two critical security flaws in PHP, a programming language that powers a significant portion of the internet. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were identified on Tuesday, October 20, triggering a global cybersecurity response. Website operators, hosting providers, and government agencies scrambled to secure their systems. Some organisations reportedly took their websites offline while preparing to apply the fixes.The vulnerabilities also prompted warnings from government cybersecurity agencies worldwide. In India, the Indian Computer Emergency Response Team (CERT-In) issued a critical-severity advisory on October 21, 2026, warning that the flaws could allow remote attackers to execute malicious code on affected systems. Meanwhile, the US National Security Agency (NSA) urged organisations to prepare for immediate security updates and recommended taking vulnerable systems offline if they could not be patched promptly.Also Read | How ‘potentially catastrophic’ eMudhra incident rattled global web securityThe incident highlights the importance of securing the software infrastructure that powers websites, particularly as artificial intelligence (AI) increasingly helps researchers discover previously unidentified security flaws.What is PHP why does it matter?In simple words, PHP is an open-source, server-side programming language used to build dynamic websites and web applications. It processes requests, interacts with databases and generates content for visitors to a website. Some of the noted platforms and frameworks, including WordPress and Laravel, depend on PHP. Since PHP primarily operates on web servers, vulnerabilities in its underlying engine can impact many applications at the same time.While a flaw in an individual website may be limited to that application, a flaw in PHP itself can likely expose numerous websites that are running on the vulnerable versions of the language. The PHP project’s official security announcement said that the October release addressed two of the critical vulnerabilities affecting PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php_cgi, FrankenPHP, LiteSpeed, etc.What are the two vulnerabilities?The first vulnerability tracked as CVE-2026-109618 involves out-of-memory (OOM) corruption. PHP employs memory to process incoming requests. Reportedly, under certain conditions, a failure in memory allocation can disrupt processing, leaving internal data only partially initialised. When PHP attempts to clean up, it may end up treating invalid data as legitimate, likely resulting in memory corruption and remote code execution. Simply put, this allows attackers to corrupt memory and run malicious code on the server.Story continues below this adThe second vulnerability – CVE-2026-109619 – involves stale global state. Essentially, under certain conditions, PHP can retain internal references to memory belonging to an earlier request even after that memory is released. A later request managed by the same worker may interact with this stale state before it has been properly reset. This can cause PHP to handle data incorrectly and potentially create a security risk.Also Read | AI agents are becoming more autonomous. Why researchers are worriedBoth the above-mentioned weaknesses affect key parts of PHP’s request processing, memory management, and error handling. According to the PHP Foundation, attackers could run malicious code on vulnerable servers under certain conditions. This was reportedly demonstrated on Apache servers using mod_php and through application-level code paths in PHP-FPM.It needs to be noted that remote code execution, or RCE, is particularly serious, as it can enable an attacker to run commands or code on a target server. A successful attack could lead to data theft, website manipulation, malware installation or further compromise, but this also depends on the server’s permissions and configuration. The vulnerabilities were rated 9.2 out of 10 under the CVSS version 4.0 severity scoring system.How did AI contribute?The discovery process shows how AI-assisted security research is rapidly changing the detection of vulnerabilities. The PHP Foundation reported that security researchers identified critical flaws through coordinated research, including work associated with external security audits and the Patch the Planet initiative. Researchers from the cybersecurity firm Calif and OpenAI independently reported the out-of-memory vulnerability, while Wiz offered additional findings.Story continues below this adFor researchers, AI tools can help them study large codebases, identify suspicious memory-handling patterns and probe potential exploitation paths. However, detecting a possible vulnerability is just one step in the entire process. Researchers and maintainers are expected to reproduce the problem, establish its impact, develop a reliable fix and test that fix against different environments.Also Read | Rogue AI agents target Indian systems: What CERT-In found, why experts are worriedMeanwhile, the PHP Foundation acknowledged that resolving the out-of-memory vulnerability involved difficult trade-offs, including compatibility concerns, performance and the risk of introducing other problems. This shows why AI-assisted discovery still requires experienced engineers and coordinated software maintenance. AI can strengthen defensive security, but similar capabilities may also help attackers develop exploits more quickly. Rapid patching and responsible disclosure therefore remain critical.What should website owners do next?Website owners should check which servers are running PHP, identify their versions and install the latest security updates. They should also check announcements from hosting providers, review deployment configuration and ensure that the updates have been applied correctly.Users of Laravel, a free open-source PHP framework, should take cognisance of their hosting arrangements. Laravel Cloud reported automatic patching of running applications, while Forge users were instructed to update PHP manually. Vapor users needed to redeploy applications according to their runtime configuration. For organisations that are unable to patch immediately, they should follow official security guidance and assess whether affected services need to be taken offline. After patching, administrators should verify service health and investigate suspicious activity if needed.Story continues below this adOverall, the PHP security incident acts as a reminder that internet security largely depends on maintaining both the underlying software and the applications built on top of it. AI tools can help researchers find security flaws, but those flaws must be fixed quickly to protect systems, signalling the gravity and urgency of cybersecurity incidents in the AI era. Website owners should check whether their systems are affected, install the security updates and make sure their servers are secure.