OpenAI’s Codex Security helps uncover two critical PHP flaws before attackers do

PHP has underpinned the server-side web since the late 1990s, and critical remote-code-execution bugs in it are rare enough to draw presidential-level attention. A coordinated disclosure was planned for October 22, giving vendors and hosts time to patch quietly before details went public, a process long used for severe bugs since mass-exploitation risk makes early leaks dangerous. That plan broke this week.

Operators running PHP-based sites, roughly 70% of those with a known server-side language, had to patch four supported branches immediately rather than on the original timetable, with some, like Sakura Internet, freezing services pre-emptively. Governments followed: Japan's prime minister urged administrators to patch overnight or shut sites down temporarily. Crypto exchanges, DeFi platforms and wallet providers were separately warned by SlowMist to treat the bugs as actively exploited, not theoretical.

The episode exposes a structural weakness in how widely-used open-source infrastructure gets funded and maintained: the PHP Foundation itself has admitted internal process and resource constraints delayed fixing a problem that became two critical vulnerabilities. A single leak turned a managed, coordinated rollout into an emergency one-day-early release, undercutting the entire premise of responsible disclosure windows for software this deeply embedded in the internet's plumbing.

Watch how many of the roughly one-third of affected sites that remained unpatched just after release close that gap, since Cloudflare's own telemetry already shows millions of exploitation attempts against CVE-2026-109618 and CVE-2026-109619. The real test is whether crypto platforms flagged by security firms patch before attackers pivot from scanning to confirmed breaches of exchange and wallet infrastructure.