{"id":2080,"date":"2026-10-22T11:16:42","date_gmt":"2026-10-22T11:16:42","guid":{"rendered":"https:\/\/seoscanpro.ai\/blog\/critical-php-vulnerabilities-2026-what-to-check\/"},"modified":"2026-10-22T13:09:43","modified_gmt":"2026-10-22T13:09:43","slug":"critical-php-vulnerabilities-2026-what-to-check","status":"publish","type":"post","link":"https:\/\/seoscanpro.ai\/blog\/critical-php-vulnerabilities-2026-what-to-check\/","title":{"rendered":"Critical PHP request-handling vulnerabilities patched: what website owners should check now"},"content":{"rendered":"
Updated October 22, 2026, at 7:14 AM ET<\/em><\/div>\n

Website owners can confirm in minutes whether their PHP install is patched against two newly disclosed memory-corruption flaws, CVE-2026-109618 and CVE-2026-109619, after the PHP maintainers shipped fixes following a coordinated response led by OpenAI, Wiz, and the upstream PHP project. The flaws sit in PHP’s request handling, and the priority for any site still running an unpatched build is applying the official update before exposing that site to untrusted traffic.<\/p>\n

What happened<\/h2>\n

OpenAI published a coordinated disclosure on October 22, 2026 describing a two-month response to critical vulnerabilities in PHP, the open-source programming language that runs a large share of the web. According to OpenAI, the firm Calif identified one of the flaws using GPT-5.6 Sol as part of its Patch the Planet initiative, and Wiz independently discovered and reported both vulnerabilities. The PHP maintainers led the fix and release, with OpenAI, Wiz, Cloudflare, and other partners contributing research, technical support, and coordination. OpenAI is sharing a PHP version checker as a Codex skill to help operators identify potentially vulnerable builds.<\/p>\n

Are you affected?<\/h2>\n

Any environment that runs PHP and serves it to untrusted HTTP traffic is in scope. According to Red Hat’s security bulletin RHSB-2026-013, published October 21, 2026, the flaws are memory-corruption issues in PHP’s request handling. CVE-2026-109618 arises when a memory allocation fails during request parsing and PHP does not roll back incomplete state, leaving cleanup to operate on uninitialized memory. CVE-2026-109619 occurs when a fatal error interrupts cleanup, leaving stale pointers to freed request memory that a later operation reuses. An unauthenticated remote attacker can trigger the corruption during PHP request processing, with potential for arbitrary code execution.<\/p>\n

Red Hat’s bulletin flags Red Hat Enterprise Linux 10, 9, and 8, plus Red Hat OpenShift Dev Spaces 3, as directly affected, along with any Red Hat product built on those bases. The PHP project has not yet published a full list of affected upstream branches in the source material reviewed here, so site owners running PHP on other operating systems should check the official PHP release notes and their distribution’s security feed. Systems without PHP installed, or that do not expose PHP to untrusted HTTP requests, are not affected. Red Hat notes that standard RHEL deployments use PHP-FPM rather than mod_php, and that PHP-FPM workers tend to exit on early initialization failures before reaching the corrupted structures, which makes remote code execution difficult in practice; environments running mod_php with default configuration are at higher risk.<\/p>\n

How to check your own site: read the PHP version on the server (for example, via php -v<\/code> from the command line or through the hosting control panel), confirm the build against the PHP maintainers’ official advisory and the Patch the Planet guidance, and review the version checker OpenAI published as a Codex skill on GitHub. A site audit will also flag the PHP version and the underlying server software in its technology report, which is where outdated builds usually surface first.<\/p>\n

What to do now<\/h2>\n
    \n
  1. Check the PHP version on every web server and staging environment, and compare it against the versions listed as fixed in the PHP maintainers’ advisory.<\/li>\n
  2. Apply the official PHP update on each affected environment, or schedule the update through your hosting provider if the host manages PHP on your behalf.<\/li>\n
  3. Confirm whether the environment runs mod_php with default configuration, since Red Hat’s bulletin places those setups at higher risk, and consider switching to PHP-FPM where the platform allows.<\/li>\n
  4. Review the official PHP upgrade instructions, Red Hat’s bulletin RHSB-2026-013, and the Patch the Planet guidance, and follow the update path that matches your distribution.<\/li>\n
  5. Run a fresh site audit after the update to confirm the new PHP build is reported and that no error pages or version banners still expose the old release.<\/li>\n<\/ol>\n

    What we are seeing<\/h2>\n

    Across the WordPress sites in NewSunSEO’s managed hosting fleet, as read on October 21, 2026, 57 of 58 sites run PHP 8.3 (specifically 8.3.36), with 1 of 58 sites returning a PHP version that was not readable. All 58 of 58 sites run WordPress 7.1.3. Operators on PHP 8.3 should still verify that their build carries the upstream fix, since the version number alone does not confirm the patch is present.<\/p>\n

    Why this matters for a site audit<\/h2>\n

    A site audit reads the software stack the way a search engine or an attacker would, and PHP version is one of the easiest signals to capture. When the audit returns an old PHP build, two follow-up checks are worth running: confirm the build against the official PHP release notes, and check whether the host has backported the fix to a long-term-support branch. For sites that sit behind a managed host, the audit report should also show the managed PHP version, not just the version reported by the application, because the application layer can mask the underlying interpreter. A technical SEO audit that includes a local SEO audit and on-page analysis will surface the PHP banner, the server software, and any pages that still reveal an outdated build, which is the same set of signals an auditor uses to flag exposure to flaws like these.<\/p>\n

    Background on the coordinated response<\/h2>\n

    OpenAI’s disclosure describes a five-stage framework for handling critical vulnerabilities in widely used software: validate and fix the upstream flaw, give affected organizations time to act, coordinate with government partners to help protect critical systems, prepare updates across affected products, and, once a patch is available, publish guidance and support deployment. For the PHP response, OpenAI says the company worked with the White House’s Super Intelligence Force, the Office of the National Cyber Director, the Cybersecurity and Infrastructure Security Agency, and international partners to help guidance reach critical organizations. OpenAI also announced $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services. CISA’s Binding Operational Directive 26-04, published June 10, 2026, sets the federal baseline for prioritizing security updates based on risk, and CISA’s Known Exploited Vulnerabilities Catalog tracks which CVEs are being actively exploited in the wild.<\/p>\n

    FAQ<\/h2>\n

    What are CVE-2026-109618 and CVE-2026-109619?<\/h3>\n

    They are two memory-corruption flaws in PHP’s request handling, disclosed on October 21, 2026. CVE-2026-109618 involves failed memory allocation during request parsing leaving incomplete state, and CVE-2026-109619 involves a fatal error interrupting cleanup and leaving stale pointers to freed request memory. An unauthenticated remote attacker can trigger the corruption, with potential for arbitrary code execution.<\/p>\n

    Who discovered the PHP vulnerabilities?<\/h3>\n

    According to OpenAI’s disclosure, Calif identified one of the flaws using GPT-5.6 Sol under the Patch the Planet initiative, and Wiz independently discovered and reported both vulnerabilities. The PHP maintainers led the fix and release.<\/p>\n

    How do I check which PHP version my site is running?<\/h3>\n

    Run php -v<\/code> from the command line on the server, or check the PHP version reported in your hosting control panel. Compare the build against the PHP maintainers’ official advisory and the Patch the Planet guidance, and confirm the version in a fresh site audit after updating.<\/p>\n

    Try the site audit tool<\/h2>\n

    \"The<\/a><\/p>\n

    SEOScanPro runs a full technical audit of a site and shows the measured result behind every check. Open the site audit tool<\/a>.<\/p>\n