php

An arXiv study evaluates five LLMs asked to modernize 100 legacy WordPress 4.0 PHP files to PHP 8.3, finding that the best model breaks 59 previously working files versus the 83 that pass unchanged, while the rule-based Rector tool breaks only 7 — concluding that LLM modernization evaluations must include a no-change baseline and report behavioral preservation separately.

TechCrunch's Equity podcast interviews Wiz CTO Tomer Schwartz about the critical PHP vulnerabilities that threatened millions of websites, and warns that AI-driven vulnerability discovery could trigger a coming 'vulnpocalypse' that makes manual patching unscalable.

On TechCrunch's Equity podcast, Wiz CTO Tomer Schwartz discusses the critical PHP bugs that nearly broke the internet and warns of an incoming 'Vulnpocalypse' as AI accelerates the discovery and exploitation of vulnerabilities in aging open-source code.

A tweet promoting a discussion with CrowdStrike on PHP2Shell, covering how the vulnerability was found, the disclosure process, and practical next steps for security teams including assessing exposure and applying fixes.

Troy Hunt's weekly update reflects on the aftermath of the 'PHP2Shell' vulnerability hype, noting the predicted cyber apocalypse never materialized and attributions to real breaches were scarce despite widespread vulnerable sites.

一篇技术博客，介绍如何在 Windows/IIS 上的 ColdFusion 或 Lucee 服务器中检测意外安装的 PHP（可能由控制面板或 phpMyAdmin 残留），并安全移除它以消除安全隐患。

TechCrunch discusses how critical PHP vulnerabilities exposed the fragility of the internet's open-source foundation and whether widespread AI and LLM agents will make discovering and exploiting such flaws far easier in the future.

黑客在 PHP 两个严重漏洞（CVE-2026-109618、CVE-2026-109619）正式补丁发布前几天就已尝试利用，据 Amazon Threat Intelligence 报告，其蜜罐系统在 10 月 17 日即检测到 PHP2Shell 攻击活动。PHP Foundation 承认修复因兼容性问题被拖延，并表示将加快未来漏洞的处理流程。

Hackers had a four-day head start exploiting severe PHP vulnerabilities discovered by OpenAI, Calif, and Wiz, flaws affecting up to 70% of websites worldwide and prompting urgent alerts from the NSA, NCSC, and White House.

Two severe vulnerabilities disclosed in PHP affect nearly 20 years of versions, knocking major sites like Wikipedia, WordPress-backed platforms, Internet Archive, and Cloudflare-protected services offline and forcing some old Japanese mobile games to permanently shut down.

AI tools from OpenAI and Google's Wiz uncovered two critical vulnerabilities in PHP affecting roughly 70% of websites, prompting emergency patches and widespread site shutdowns including parts of Wikipedia and over 200 Japanese organizations.

Amazon Threat Intelligence 通过 MadPot 蜜罐在 CVE-2026-109618/109619 公开披露前四天（10月17日）就发现了 PHP2Shell 漏洞利用尝试，且 AI 辅助分析正显著缩短从补丁发布到可用漏洞利用的时间。

A Hacker News poster apologizes for unknowingly breaking the embargo on two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), disrupting the coordinated disclosure schedule.

Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were independently discovered by a frontier AI model after being given only the prompt "find bad vulnerabilities in PHP".

AWS threat intelligence reveals attackers began exploiting the critical PHP2Shell vulnerabilities four days before their public disclosure and patch release, highlighting how AI-accelerated exploit development is shrinking the window between patch and working exploit.

Four major cybersecurity incidents came to light in less than 24 hours: a high-severity remote code execution vulnerability that had remained hidden in PHP for 14 years (discovered using AI in an OpenAI-led effort, with a patch already released); Node.js fixing 10 vulnerabilities at once; Indian certificate authority eMudhra having its weakly generated private keys cracked, threatening the HTTPS chain of trust; and a breach of cloud platform Railway that may have exposed all customer API keys.

A tweet lamenting that today was the worst day in the history of internet security: PHP dropped two critical vulnerabilities on the same day, allowing attackers to execute code remotely without logging in, and details leaked before patches were even released, affecting major systems such as WordPress, MediaWiki, Magento, Joomla, and Laravel. The author faithfully translated the original post into Chinese, preserving its style.

The author argues that the latest high-profile PHP vulnerability is far less exploitable than Log4Shell or Heartbleed, and that the thousands of circulating 'PoC' exploits are largely broken artifacts generated by LLMs that modify test environments instead of chaining the real bug.

CZ warns users to be cautious browsing the web after two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting WordPress and Magento servers were exploited in the wild following an early leak, prompting patches and WAF protections.

Two critical PHP vulnerabilities—discovered with the help of AI models like GPT-5.6 Sol—caused widespread site outages across the internet, affecting 4chan, Wikipedia, DeviantArt, government agencies, and Pokémon services.