PHP patched in hours: how we used AI agents
On 21 October, we responded to the critical PHP security disclosure by patching servers across Exascale’s own infrastructure and client environments. We used AI agents to help carry out the work and update application codebases, allowing applications to move to patched PHP releases within hours.
The PHP security release
The release addressed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow an attacker to execute code without authentication under certain conditions. PHP’s maintainers released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and urged users to update immediately. The official PHP advisory sets out the affected systems and upgrade options.
Why application compatibility mattered
Getting a security update installed can be straightforward when an application already runs on a supported PHP branch. Older applications can take more work. Moving them to a newer runtime may mean changing code or updating dependencies before the upgrade can go ahead. During an urgent patching exercise, that application work can become the main delay.
How AI agents helped
We used agents powered by efficient AI models to work on those code changes. The task was specific: update the existing applications so they could run on the remediated PHP version. This gave us more capacity to handle the codebase work alongside the server updates.
Efficient models suited the job: we needed to make focused compatibility changes quickly across the codebases involved. They helped us work through the application updates while server patching was under way.
Patching our own and client systems
The response covered clients’ systems as well as our own. By dealing with application changes as part of the patching work, we could help clients move forward without leaving the compatibility problem for a separate development project.
The underlying security fixes were provided by PHP’s maintainers. Our application changes enabled the upgrades. Reviewing those changes, testing the applications and checking that the running services have picked up the patched runtime remain necessary parts of the job.
Urgent upgrades often get held up by the application work around them. Using agents for that work helped us get both our own systems and client applications onto patched PHP releases within hours.