Drupal
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 4
- AI models help uncover chained PHP2Shell remote-code-execution flaws
O’Reilly Radar, citing Wiz Research, reports that Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol helped uncover two chained PHP remote-code-execution vulnerabilities, later identified as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urged all installations to update, while sites unable to upgrade were advised to go offline and be isolated. The reported timeline also says Amazon apparently detected exploitation before the vulnerabilities were prematurely disclosed and patched.
O’Reilly Radar · 🔥 0 - AI Models Helped Discover PHP2Shell Vulnerabilities
Wiz researchers said they used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol to identify two PHP vulnerabilities in late August, then validated them in Drupal and WordPress before reporting them to the PHP development team. The flaws date back at least to PHP 5.4, released in 2012. PHP subsequently released patches for the two vulnerabilities, both rated critical under CVSS v4.0. Accounts differ on whether exploitation occurred before disclosure: Amazon said it first detected activity on October 17, while CISA said it had not observed exploitation.
iThome 台湾 · 🔥 0 - Two PHP flaws expose much of the web, with GPT-5.6 Sol cited in flaw discovery
The Verge AI reports that two vulnerabilities in the PHP programming language put enormous swaths of the internet in danger, citing accounts that up to 70 percent of websites use PHP in some capacity. According to the report, DeviantArt and 4Chan were temporarily shut down after the vulnerabilities were disclosed, the Internet Archive was briefly forced offline, and two old-school Japanese mobile games are shutting down over the exploit. The report says the vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported, and that security firm Wiz called the flaws among the most severe vulnerabilities discovered in software history; it also states that GPT-5.6 Sol was used to identify a critical PHP flaw.
The Verge AI · 🔥 0 - Drupal is 'light-years ahead of its reputation,' founder says, unveiling AI demo
Drupal founder Dries Buytaert used his DrupalCon Rotterdam 2026 DriesNote to argue that Drupal is "now light-years ahead of its reputation" and that closing that gap is the community's number one challenge. He pointed to Drupal CMS, which grew out of the Starshot initiative he launched just over two years earlier and brings together Site Templates, Recipes, Drupal AI and Drupal Canvas, and he announced a preconfigured Drupal AI demo, Drupal Canvas Headless for JavaScript front-ends such as Next.js, Astro, TanStack, Angular or Nuxt, and a new advocacy program that lets advocacy work earn contribution credit. Buytaert also described the Tool module and a planned Tool API change developed with Matt Glaman that would expose existing PHP methods as tools using attributes, which he said cut roughly 1,000 lines of integration code in his own album module to about 20 attributes.
Hacker News 首页（100+ 分） · 🔥 0
Experience and discussion from the community
Share my Drupal experienceAsk about Drupal
Nobody has shared their experience with Drupal yet.