Ondřej Surý Packages 2 PHP Security Fixes as AI-Found Flaws Spark Global Patch Race
Updated
Updated · BBC.com · Oct 24
Ondřej Surý Packages 2 PHP Security Fixes as AI-Found Flaws Spark Global Patch Race
3 articles · Updated · BBC.com · Oct 24
Summary
Two major PHP vulnerabilities pushed Ondřej Surý to rapidly turn the PHP Foundation’s fixes into Debian and Ubuntu packages, letting website operators install patches without deep technical work.
An early leak forced the release timetable forward, shrinking Surý’s preparation window as fears grew that attackers could exploit the flaws before many servers were updated.
Surý, who maintains those PHP packages voluntarily alongside his day job, said the week brought more than $10,000 in donations—about a year’s usual support—and renewed his call for big tech to fund open-source infrastructure.
The episode underscored how much of the internet depends on a small pool of maintainers, while Surý warned AI is speeding up vulnerability discovery and could make such emergency patching more frequent.
With hackers already exploiting critical PHP flaws, is your website's hidden infrastructure a ticking time bomb waiting to be breached?
Will taking your website offline to avoid this critical PHP vulnerability ultimately cause more financial damage than the hackers themselves?
CVE-2026-109618/109619: Inside the October 2026 PHP Remote Code Execution Emergency and Its Global Web Impact
Overview
On October 20, 2026, an early leak exposed technical details of two critical PHP remote code execution vulnerabilities, prompting the PHP team to announce an emergency patch release. Security researchers confirmed the flaws, which exist in the PHP core engine and can bypass application-level protections, threatening popular platforms like WordPress and Laravel. Because many servers run unsupported PHP versions, over a million hosts will not receive official patches, leaving them open to attacks that can lead to server compromise and data theft. Regulatory bodies urged urgent action, while industry experts stressed that only direct PHP updates—not standard CMS updates—can address the risk.