National Security Agency
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 3
- GPT-5.6 Sol helped find two critical PHP flaws, now patched
The Rundown AI reported that OpenAI's GPT-5.6 Sol helped researchers identify two critical flaws in PHP, the language behind roughly 70% of websites, and that PHP maintainers have now released patches. The newsletter said security firm Calif found the first bug on Aug. 1 using GPT-5.6 Sol, while Google-owned Wiz separately caught both flaws weeks later with Sol and Gemini 4 Argon. According to the report, OpenAI said it worked with PHP maintainers on patches for two months and called the find one of the most impactful security issues in recent memory; the NSA urged organizations unable to patch to take systems offline, and Cloudflare said it was seeing early attacks.
The Rundown AI · 🔥 0 - AI-found PHP2Shell flaws under mass exploitation as PHP ships emergency patches
PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21 to fix two memory flaws collectively called PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The PHP Foundation said security firm Calif used OpenAI's GPT-5.6 Sol on August 11 to confirm the bugs could yield unauthenticated remote code execution, while Wiz independently found the first flaw using Gemini 4 Argon and GPT-5.6 Sol. Hadrian reported mass exploitation attempts, mainly through PHP's session upload-progress mechanism, about two and a half hours before the patches appeared, and Amazon said attackers tried to exploit the flaws four days before public disclosure.
iThome 台湾 · 🔥 0 - UK checks exposure after AI-discovered critical PHP flaws spark global scramble
The UK government said it is working to identify any potential exposure in its online services after critical cyber-security flaws were found in PHP, the programming language underpinning a significant number of the world's websites. According to the BBC, the flaws were first discovered by AI and went undetected for at least a decade; the UK's National Cyber Security Centre, along with EU and Australian counterparts, urged PHP users to apply fixes, and the NSA said the flaws often provide a direct path to a server's file system or database. Amazon said it detected a "PHP2Shell exploitation attempt" on 17 October against a honeypot system and further attempts on 21 October that varied in payload and anonymisation infrastructure, occurring after details leaked on social media but before an embargo was lifted.
The Next Web · 🔥 0
Experience and discussion from the community
Share my National Security Agency experienceAsk about National Security Agency
Nobody has shared their experience with National Security Agency yet.