The PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, security releases that fix two critical vulnerabilities that can allow unauthenticated remote code execution and that were discovered with frontier AI models. The coordinated disclosure spanned the PHP project, OpenAI, security research firm Calif, and cloud security company Wiz. The Patched Releases The PHP project’s security advisory states that the four releases fix CVE-2026-109618, described as remote code…