A programming bug discovered during a routine server check has caused chaos throughout the internet this week. The flaw was significant, but because so many systems use it, the exploit affected everyone who used them, sending them into panic mode and causing confusion and emergency shutdowns until the patch was released.
The issue stems from a routine assessment that began August 1st. The flaw itself is in the programming language PHP. PHP is a programming language that allows websites to send their information to your searching device. It’s an old programming language dating to the early 90s, so much so that most of the internet runs on some form of it. It's completely open source, and around 70 percent of known servers have this.
On August 11th, the security company Calif, working with OpenAI and Alphabet, the parent company of Google, discovered a flaw that could allow for an unauthorized user to get in without having to even authenticate their credentials. Further testing revealed a second more serious problem on August 25th, forcing the PHP code holder to create a patch that fixed this vulnerability.
What makes it more troubling is that AI was the one who discovered it. PHP has admitted that the flaw has been in the code for over a decade. It would have taken months with some of the best engineers that PHP could find to find the same vulnerabilities. The AI found it in ten days, which alarmed them enough to keep it under wraps until they could find a patch that worked.
The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.
- CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. (1)
The original plan was to find a workable solution, roll it out and then announce the patch on October 22nd. But someone leaked the plans a day early, forcing the patch to roll out across the globe without warning. This came with two glaring problems. One, some 70 percent of known servers has or had PHP as part of their website integration process. Two, some of these systems were legacy systems, so even if they could get the patch, it wouldn’t be compatible as only certain versions could even accepted the patch. PHP reports that any server running a patch before its 8.2 version will not be able to get the patch, which is a part of the end of service on the related systems.
On October 21st, Cloudflare reported early exploitation attempts against both flaws signaling attackers are already weaponizing these flaws in the wild. Given the reach of PHP, the leaked exploit details, and reported attacks, Beazley Security recommends affected organizations apply available fixes immediately and conduct a thorough review for any signs of compromise. (2)
The chaos that premature notice caused massive reactions over the globe. Some systems were online quickly as they were ready to patch within hours of the announcement. Other websites weren’t as fortunate and had to wait on the patches. The EU went a step further and said to take the websites offline if they couldn’t get the patch in time, this included government websites and banking apps. This is because while everyone was scrambling to put the new patch in, hackers saw this as Christmas coming early and there were reports of attempted breaches already flooding into Cloudflare. (3)
PHP is recommending that you can update immediately, as its considered the only surefire solution. If they can’t do it right away, they recommend either taking the affected server offline, or limiting who has access to the affected server via code changes or isolating the affected computer. The chaos is such that they’re willing to temporarily issue patches to older versions of their programs.
What began as AI finding a vulnerable bug that PHP has admitted has been in their systems for years turns into chaos as websites and governments scramble to fix their servers and websites before hackers could take advantage of it. Legacy systems continue to be a problem for many websites as these security patches may not necessarily apply to their version of PHP. With over 70 percent of the internet using some form of a 1993 code, the potential damage was catastrophic, compounded by the fact that the patch was leaked too soon has led to chaos throughout the world.
About Axis
At Axis Insurance Services, LLC, we’re proud of our reputation in building highly customized insurance solutions for all types of professional service companies and their employees. We believe our diverse product options and outstanding customer service help us earn our clients’ trust and loyalty.
What sets us apart from other insurance brokers is our deep understanding of the market and our ability to tailor coverage options in sync with our clients’ objectives. Professional and Management Liability policies can be a commodity – we only build custom coverage solutions that work.
Leading the Industry for Over Twenty Five Years
Celebrating its 25th year anniversary in 2024, Axis Insurance Services, LLC, is proud of our reputation in building highly customized insurance solutions for all types of professional service companies and their employees. We believe our diverse product options and outstanding customer service help us earn our clients’ trust and loyalty.
Formed in 1999, Axis Insurance Services, LLC is a nationwide leader in the professional and management liability insurance industry, developing innovative risk management solutions for today’s evolving businesses. We offer insurance programs to a broad array of professionals and industries, including insurance agents/brokers, attorneys, commercial real estate firms, technology, healthcare/medical, financial institutions, architects/engineers, consulting firms, media, and many others.
In 2014, we launched PLRisk in 2014 and today the two firms provide retail and wholesale coverage solutions for Cyber Liability & Privacy/Network Security, Errors and Omissions, Directors and Officers, Employment Practices Liability, Commercial Crime and Fiduciary coverage.
