Wiz researchers said they used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol to identify two PHP vulnerabilities in late August, then validated them in Drupal and WordPress before reporting them to the PHP development team. The flaws date back at least to PHP 5.4, released in 2012. PHP subsequently released patches for the two vulnerabilities, both rated critical under CVSS v4.0. Accounts differ on whether exploitation occurred before disclosure: Amazon said it first detected activity on October 17, while CISA said it had not observed exploitation.