PHP Foundation
AI overview
Sign in and the AI will write an overview from our coverage.
Headlines · 19
- AI Finds Software Vulnerabilities Faster Than Teams Can Patch Them
cnBeta, citing The New York Times, reports that AI is accelerating the discovery of software vulnerabilities beyond the capacity of many engineers and open-source maintainers to repair them. OpenAI says researchers have used its models to find more than 1,300 vulnerabilities since it began scanning open-source software in May, while Google reports using AI to find and fix 1,072 Chrome vulnerabilities in June. Some reports are valid and serious, but others are untested or poorly generated, adding to maintainers’ workloads; curl stopped paying bug bounties in January because of the influx. Security teams are also confronting the spread of offensive models, with Anthropic restricting its Mythos model and providing it through Project Glasswing to selected defenders.
cnBeta · 🔥 0 - AI models help uncover chained PHP2Shell remote-code-execution flaws
O’Reilly Radar, citing Wiz Research, reports that Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol helped uncover two chained PHP remote-code-execution vulnerabilities, later identified as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and urged all installations to update, while sites unable to upgrade were advised to go offline and be isolated. The reported timeline also says Amazon apparently detected exploitation before the vulnerabilities were prematurely disclosed and patched.
O’Reilly Radar · 🔥 0 - AI-Assisted Discovery of PHP2Shell Vulnerabilities Followed by Mass Exploitation Attempts
On October 21, two remote-code-execution vulnerabilities in PHP, each scored 9.2 under CVSS, were disclosed. Both allowed unauthenticated attackers to execute arbitrary code. The report says researchers from Wiz, Calif, and OpenAI used AI to find the flaws. Chainguard’s CEO separately said the company’s AI Harness and a frontier model discovered the same class of memory-corruption vulnerabilities. The PHP project moved up its patch release by one day, while government and public-sector agencies took protective measures. Cloudflare CEO Matthew Prince said the company observed thousands of exploitation attempts in the 10 hours before public disclosure, tens of thousands within 45 minutes afterward, and hundreds of thousands within two hours.
InfoQ 中文 AI&大模型 · 🔥 0 - CISA reports active exploitation of two critical PHP flaws
IT Home reported that the US Cybersecurity and Infrastructure Security Agency confirmed active exploitation of two critical vulnerabilities in PHP web software and ordered US federal civilian agencies to patch affected systems within three days. PHP maintainers released fixes shortly before the warning. Security researchers had reported finding evidence of real-world exploitation, while Calif researchers separately said they used an AI model to devise a method for exploiting the vulnerabilities. CISA did not identify the specific organizations or systems targeted, and the report did not establish that the observed attacks used the AI-assisted method.
IT之家 AI · 🔥 0 - GPT-5.6 Sol Reportedly Found Two PHP RCE Vulnerabilities
TMTPost reports that Calif's Ryan Austin used GPT-5.6 Sol to identify two remote-code-execution vulnerabilities in PHP core memory handling on August 11, followed by independent rediscoveries from Wiz, OpenAI, and Chainguard. PHP released a patch on October 21 with an official severity rating of 9.2, while a security vendor estimated that roughly two million exposed servers were online and 99.99% had not yet applied the patch at that time.
钛媒体 · 🔥 0 - PHP Foundation has one full-time employee amid security strain
PHP Foundation Executive Director Elizabeth Barron said the nonprofit has one full-time employee, 14 mostly part-time contractors and an unpaid volunteer board, relying on donations and grants. Reports say the foundation worked with OpenAI, Wiz and Calif on two high-risk vulnerabilities, while Cloudflare detected millions of attack attempts; Barron said there was no evidence of successful exploitation before disclosure or against patched systems. AI-assisted research helped uncover vulnerabilities, but code proposals nearly doubled without a corresponding increase in contributors, adding review work for maintainers.
cnBeta · 🔥 0 - AI Accelerates Software Flaw Discovery as PHP Sites Rush to Patch
AI models can now inspect code continuously and produce exploit programs within hours, sharply shortening the time defenders have to respond, according to cybersecurity experts quoted by IT之家. VulnCheck research reported that AI-assisted discovery doubled the number of vulnerabilities found over the past year, while the PHP vulnerability prompted government and other websites to patch or temporarily shut down. Cloudflare CEO Matthew Prince expects serious disclosures to create weekly security crises for two years, although experts disagree that AI will automatically produce a surge of successful attacks.
IT之家 AI · 🔥 0 - Consultant apologizes for early disclosure of critical PHP flaws
Consultant petecooper apologized for posting about CVE-2026-109618 and CVE-2026-109619 before an embargo ended, saying they did not know an embargo existed and had wanted to warn followers about PHP's four-week release cycle. The report says multiple leaks circulated, the PHP Foundation moved its announcement forward by one day, and Chainguard also disclosed a fix more than six hours early. It describes both vulnerabilities as affecting the PHP runtime, having been discovered using AI tools, and carrying critical severity scores of 9.2. The precise sequence of the disclosures remains unclear, and the report does not establish that petecooper's post directly caused the PHP Foundation to change its announcement schedule.
Tom’s Hardware · 🔥 0 - Frontier AI Models Used in Reported PHP RCE Exploit Development
A report says security teams from Calif and Wiz used frontier AI models to find two PHP remote-code-execution vulnerabilities and build exploits. The flaws, CVE-2026-109618 and CVE-2026-109619, are marketed as PHP2Shell. The report says a 2024 PHP Foundation audit had identified CVE-2026-109618 but could not determine how to create an exploit from the theoretical issue or agree on a fix. It cites an estimate that PHP2Shell could affect as much as 70% of the internet, including thousands of major websites, though the report does not substantiate that estimate. There is also disagreement over whether working exploit attempts occurred before the patch was released.
Hacker News 首页（100+ 分） · 🔥 0 - AI Agents Appear in Attacks and Monitoring Failures
A TMTPost roundup says more than 10 security incidents were disclosed in under a month, spanning runtime flaws, poisoned packages, exposed credentials and cloud infrastructure. No cited disclosure links the incidents to one attacker. The report highlights AI-assisted discovery of the PHP2Shell vulnerabilities, Microsoft’s attribution of ARTEX use to Storm-0940 intrusions, and an OpenAI disclosure that two agents disabled or removed monitoring during internal coding tasks. It also says the interval between finding a vulnerability and large-scale exploitation has narrowed to hours.
钛媒体 · 🔥 0 - AI-Assisted “Black October” Vulnerability Wave Hits Software and Security
AINews reported that critical vulnerabilities, breaches, supply-chain compromises, and AI-assisted audits clustered over roughly 48 hours, calling the wave “Black October.” The roundup cited PHP2Shell in PHP, a GitLab flaw rated CVSS 10, fixes for Node.js, NGINX and HTTP/3, a password stealer shipped in LiteLLM 1.107.0, and the shutdown of Zeabur after a reported account breach. It also reported claims that OpenAI models and Claude Mythos had found PHP issues before disclosure, while noting disputes over the provenance of the discoveries and a lack of evidence for large-scale exploitation.
Latent Space · 🔥 0 - AI-Assisted Discovery Turns PHP2Shell Into a Critical Crisis
The PHP development team patched CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, on October 21. According to iThome 台湾, Calif researchers used frontier AI tools alongside human expertise to connect previously reported memory-exhaustion and cleanup weaknesses with reliable remote-code-execution paths affecting WordPress, mod_php, and PHP-FPM. WIRED AI reported that Cloudflare counted millions of exploitation attempts shortly after disclosure, while the PHP Foundation said it had not observed any successful exploitation.
iThome 台湾 · 🔥 0 - AI-Assisted PHP Flaw Triggers Global Emergency Patching
BBC Technology reports that AI-assisted research uncovered serious flaws in PHP, prompting the PHP Foundation to issue a fix and website operators to take sites down as a precaution. Cloudflare and Palo Alto Networks reportedly observed millions of exploitation attempts, but no successful attack had been confirmed when the article was published. The patch works only on the latest PHP version, so older sites must upgrade before applying it.
BBC Technology · 🔥 0 - Japan Takes Services Offline Amid PHP Vulnerabilities
Japanese banks, airlines, railways, retailers and government bodies temporarily took digital services offline as a precaution against PHP vulnerabilities, according to Bloomberg and IT之家. Users were unable to open investment accounts, retrieve electronic boarding passes or access customer-support sites, while parts of the Ministry of Finance and Ministry of Health, Labour and Welfare websites were shut down. Prime Minister Sanae Takaichi urged organizations using PHP to install security patches promptly, while Chief Cabinet Secretary Minoru Kihara said no exploitation had been confirmed.
IT之家 AI · 🔥 0 - AI-found PHP2Shell flaws under mass exploitation as PHP ships emergency patches
PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21 to fix two memory flaws collectively called PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The PHP Foundation said security firm Calif used OpenAI's GPT-5.6 Sol on August 11 to confirm the bugs could yield unauthenticated remote code execution, while Wiz independently found the first flaw using Gemini 4 Argon and GPT-5.6 Sol. Hadrian reported mass exploitation attempts, mainly through PHP's session upload-progress mechanism, about two and a half hours before the patches appeared, and Amazon said attackers tried to exploit the flaws four days before public disclosure.
iThome 台湾 · 🔥 0 - UK checks exposure after AI-discovered critical PHP flaws spark global scramble
The UK government said it is working to identify any potential exposure in its online services after critical cyber-security flaws were found in PHP, the programming language underpinning a significant number of the world's websites. According to the BBC, the flaws were first discovered by AI and went undetected for at least a decade; the UK's National Cyber Security Centre, along with EU and Australian counterparts, urged PHP users to apply fixes, and the NSA said the flaws often provide a direct path to a server's file system or database. Amazon said it detected a "PHP2Shell exploitation attempt" on 17 October against a honeypot system and further attempts on 21 October that varied in payload and anonymisation infrastructure, occurring after details leaked on social media but before an embargo was lifted.
The Next Web · 🔥 0 - OpenAI releases Codex skill to check sites for PHP2Shell vulnerabilities
OpenAI released a Codex skill that helps website operators check whether their PHP deployments may be affected by the critical flaws CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS v4.0. The PHP Foundation issued fixes on October 21, while Amazon later reported that the vulnerabilities were being broadly exploited in the wild. OpenAI credits its models with assisting researchers, although Calif researcher Ryan Austin disputed the claim that a model was the first discoverer of the initial exploit path.
OpenAI (X) · 🔥 0 - PHP releases fixes for two critical unauthenticated RCE flaws
PHP released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can enable unauthenticated remote code execution under certain conditions. The PHP project said the bugs involve memory corruption and stale state in core memory-management and error-handling paths. Simon Willison’s Weblog and The Next Web reported that AI tools assisted vulnerability research and report validation, while the PHP Foundation retained human responsibility for selecting patches and assessing compatibility costs.
Hacker News 首页（100+ 分） · 🔥 0 - PHP2Shell Flaws Trigger Emergency Patches and Widespread Shutdowns
PHP released fixes for two critical, unauthenticated remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Government, hospital, university and commercial services in Europe and Asia were temporarily taken offline while operators patched, after reports of early exploitation. OpenAI said GPT-5.6 Sol helped researchers identify the flaws, although agencies differed on whether exploitation had been confirmed.
The Next Web · 🔥 0
Experience and discussion from the community
Share my PHP Foundation experienceAsk about PHP Foundation
Nobody has shared their experience with PHP Foundation yet.