{"id":846,"date":"2026-10-22T11:17:05","date_gmt":"2026-10-22T11:17:05","guid":{"rendered":"https:\/\/managedt.com\/blog\/critical-php-memory-corruption-flaws-small-business\/"},"modified":"2026-10-22T11:17:06","modified_gmt":"2026-10-22T11:17:06","slug":"critical-php-memory-corruption-flaws-small-business","status":"publish","type":"post","link":"https:\/\/managedt.com\/blog\/critical-php-memory-corruption-flaws-small-business\/","title":{"rendered":"Critical PHP Memory Corruption Flaws: What Small Businesses Should Do Now"},"content":{"rendered":"
Updated October 22, 2026 at 7:15 AM ET<\/em><\/div>\n

Two critical memory corruption vulnerabilities in PHP’s request handling could allow remote code execution on affected servers, and patches are rolling out across distributions now. For small businesses running websites, customer portals, or any web app on PHP, the priority is confirming your PHP version and applying the upstream fix as soon as your provider makes it available. The flaws were coordinated through OpenAI’s Patch the Planet initiative, with researchers at Calif identifying them using a GPT-based system and Wiz independently reporting the same issues, according to OpenAI’s disclosure<\/a>.<\/p>\n

What happened<\/h2>\n

Two memory corruption flaws in PHP’s request handling code, tracked as CVE-2026-109618 and CVE-2026-109619, can be triggered by an unauthenticated remote attacker during normal PHP request processing. Under certain conditions, the bugs can lead to arbitrary code execution on the server, according to Red Hat security bulletin RHSB-2026-013<\/a>. OpenAI described the combined impact as one of the most significant PHP security issues in recent memory, given how widely the language is deployed across websites and web applications.<\/p>\n

Are you affected?<\/h2>\n

You may be affected if your business runs PHP on a public-facing web server, a content management system like WordPress or Drupal, an e-commerce platform, a customer portal, or any web application built on PHP. The vulnerabilities affect PHP’s core request handling, so any environment that processes untrusted HTTP input through PHP is potentially in scope.<\/p>\n

Red Hat lists Red Hat Enterprise Linux 8, 9, and 10, along with Red Hat OpenShift Dev Spaces 3, as directly affected. Any product built on RHEL or UBI container images is potentially impacted, and customer containers should be rebuilt when base images are updated.<\/p>\n

Not every PHP installation is equally exposed. Red Hat notes that standard RHEL deployments use PHP-FPM rather than mod_php. PHP-FPM workers tend to exit on early initialization failures before reaching the corrupted structures, which makes remote code execution harder in practice. Environments running mod_php with default configuration face higher risk.<\/p>\n

Systems that do not have PHP installed, or that do not expose PHP to untrusted HTTP requests, are not affected.<\/p>\n

PHP’s maintainers have released upstream patches. The fix is in the PHP version checker tool OpenAI published as a Codex skill, available at the php2shell-checker repository<\/a>, which helps operators identify potentially vulnerable PHP versions and determine which updates apply. Specific affected PHP version numbers were not listed in the source materials reviewed; check your distribution’s advisory and the upstream PHP release notes for the exact patched versions.<\/p>\n

What to do now<\/h2>\n
    \n
  1. Identify every server and container in your environment that runs PHP. Include web servers, application servers, container images, and any managed hosting accounts where your provider controls the PHP install.<\/li>\n
  2. Check the PHP version on each system. Use the php2shell-checker tool from OpenAI’s repository, your distribution’s package manager, or a php -v command on the server to confirm the running version.<\/li>\n
  3. Apply the upstream PHP patch as soon as your distribution makes it available. Red Hat states that some updates are already available with additional updates in progress.<\/li>\n
  4. Rebuild any custom container images based on RHEL or UBI base images once updated base images are published, and redeploy workloads running on those images.<\/li>\n
  5. Contact your hosting provider or web host if you do not manage the server yourself, and ask them to confirm the PHP version in use and when the fix will be applied. For mod_php environments, ask specifically whether a switch to PHP-FPM is available as an interim mitigation.<\/li>\n<\/ol>\n

    How the response was coordinated<\/h2>\n

    OpenAI’s Patch the Planet initiative brought together maintainers, researchers, and security providers to validate the finding, develop the fix, and prepare protections before public disclosure. The PHP maintainers led the fix and release, with OpenAI, Wiz, Cloudflare, and others contributing research, testing, and coordination. Government cyber agencies, including CISA, the Office of the National Cyber Director, and international partners, were engaged to help guidance reach critical organizations.<\/p>\n

    OpenAI stated that, to its knowledge, frontier AI found these vulnerabilities before attackers did, giving maintainers and defenders a window to prepare fixes ahead of disclosure. The company also committed $1 billion in subsidized access to its Daybreak security tooling through a program called Daybreak for Frontline Defenders, aimed at organizations with limited security resources protecting essential services.<\/p>\n

    Why this matters for small-business IT<\/h2>\n

    PHP runs an enormous share of the web, from small-business websites and WordPress blogs to customer portals and online stores. A memory corruption flaw in PHP’s request handling is the kind of vulnerability that automated scanners and exploit kits find quickly once details become public. The faster a small business confirms its PHP version and applies the patch, the smaller the window of exposure.<\/p>\n

    Red Hat’s bulletin also notes that the bugs are in request handling rather than in application logic, which means the patch has to come from the PHP runtime, not from a WordPress plugin update or a configuration change in your CMS. The fix lives at the server or container level.<\/p>\n

    For businesses that rely on a managed host or a web developer for server maintenance, this is a good moment to ask directly which PHP version is in production and whether the patch has been scheduled. Do not assume the host has applied the fix just because an update was announced.<\/p>\n

    Assessing your urgency<\/h2>\n

    CISA’s Binding Operational Directive 26-04, issued June 10, 2026, provides a framework for prioritizing security updates based on risk rather than treating all vulnerabilities equally. The directive looks at four variables: whether the asset is publicly exposed, whether the vulnerability appears in CISA’s Known Exploited Vulnerabilities Catalog, whether exploitation can be automated, and the technical impact if exploited.<\/p>\n

    For a small business, the practical question is whether your PHP server is internet-facing and whether you can apply the patch quickly. If your web server is publicly accessible and you manage it yourself, treat this as a high-priority update. If your host manages the server, ask for a timeline and confirm the patched version is running once the update is deployed.<\/p>\n

    FAQ<\/h2>\n

    What is CVE-2026-109618?<\/h3>\n

    CVE-2026-109618 is a memory corruption flaw in PHP’s request handling that occurs when a memory allocation fails during request parsing. PHP does not roll back incomplete state, and subsequent cleanup operates on uninitialized memory, according to Red Hat security bulletin RHSB-2026-013.<\/p>\n

    What is CVE-2026-109619?<\/h3>\n

    CVE-2026-109619 is a memory corruption flaw in PHP’s request handling that occurs when a fatal error interrupts cleanup, leaving stale pointers to freed request memory that are reused by a later operation, according to Red Hat security bulletin RHSB-2026-013.<\/p>\n

    How do I check if my PHP version is vulnerable?<\/h3>\n

    Run php -v on the server, check your distribution’s package manager, or use the PHP version checker tool OpenAI published at the php2shell-checker repository on GitHub. Confirm with your hosting provider if you do not manage the server yourself.<\/p>\n