Chainguard
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 4
- AI-Assisted Discovery of PHP2Shell Vulnerabilities Followed by Mass Exploitation Attempts
On October 21, two remote-code-execution vulnerabilities in PHP, each scored 9.2 under CVSS, were disclosed. Both allowed unauthenticated attackers to execute arbitrary code. The report says researchers from Wiz, Calif, and OpenAI used AI to find the flaws. Chainguard’s CEO separately said the company’s AI Harness and a frontier model discovered the same class of memory-corruption vulnerabilities. The PHP project moved up its patch release by one day, while government and public-sector agencies took protective measures. Cloudflare CEO Matthew Prince said the company observed thousands of exploitation attempts in the 10 hours before public disclosure, tens of thousands within 45 minutes afterward, and hundreds of thousands within two hours.
InfoQ 中文 AI&大模型 · 🔥 0 - Goodside’s “Prompt Engineering Is Dead” Remark Draws Discussion
Riley Goodside reposted Justin Elze’s “You’re all prompting wrong” post and wrote, “Prompt engineering is dead. Prompt however you want. Have fun.” He later said the remark was a joke. The 36Kr report frames the exchange as commentary on everyday prompting becoming less distinct from context and harness engineering, including the system design behind Chainguard’s AI vulnerability discovery tool.
36氪 人工智能 · 🔥 0 - GPT-5.6 Sol Reportedly Found Two PHP RCE Vulnerabilities
TMTPost reports that Calif's Ryan Austin used GPT-5.6 Sol to identify two remote-code-execution vulnerabilities in PHP core memory handling on August 11, followed by independent rediscoveries from Wiz, OpenAI, and Chainguard. PHP released a patch on October 21 with an official severity rating of 9.2, while a security vendor estimated that roughly two million exposed servers were online and 99.99% had not yet applied the patch at that time.
钛媒体 · 🔥 0 - Consultant apologizes for early disclosure of critical PHP flaws
Consultant petecooper apologized for posting about CVE-2026-109618 and CVE-2026-109619 before an embargo ended, saying they did not know an embargo existed and had wanted to warn followers about PHP's four-week release cycle. The report says multiple leaks circulated, the PHP Foundation moved its announcement forward by one day, and Chainguard also disclosed a fix more than six hours early. It describes both vulnerabilities as affecting the PHP runtime, having been discovered using AI tools, and carrying critical severity scores of 9.2. The precise sequence of the disclosures remains unclear, and the report does not establish that petecooper's post directly caused the PHP Foundation to change its announcement schedule.
Tom’s Hardware · 🔥 0
Experience and discussion from the community
Share my Chainguard experienceAsk about Chainguard
Nobody has shared their experience with Chainguard yet.