php

A potential third critical PHP CVE is surfacing, raising fresh security concerns for web developers and servers relying on the popular scripting language.

PHP 8.x 全系发布紧急安全更新，修复两个远程代码执行漏洞；因协调披露流程泄露导致 PoC 提前扩散，PHP Foundation 与 Wiz 公布了完整披露时间线。

OpenAI's Patch the Planet initiative and Google's Wiz used AI models like GPT-5.6 Sol and Gemini 4 Argon to uncover two critical, decades-old PHP vulnerabilities present since 2004, prompting an NSA warning and urgent patches from the PHP Foundation for the ~70% of websites running PHP.

OpenAI 发布了一个 Codex skill（php2shell-checker），帮助用户检查网站或本地 PHP 是否易受 php2shell 漏洞影响，作为其 Patch the Planet 安全倡议的一部分。

Wiz disclosed PHP2Shell, two critical decade-old PHP vulnerabilities that researchers turned into working exploits in about a week with help from Gemini and GPT models, prompting emergency patching and raising questions about AI-driven exploitation of legacy code.

Two critical PHP runtime vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed php2shell) that had existed for over a decade were demonstrated as exploitable with the help of frontier AI models, prompting a coordinated defense across the web including pre-disclosure Cloudflare WAF protections.

Two critical PHP vulnerabilities, described as the most severe ever discovered by AI, prompted global governments and agencies to take websites offline while awaiting fixes. The flaws, found by researchers at Calif and Wiz using OpenAI models, had gone undetected for over a decade and reportedly affect roughly 70% of the internet.

PHP 项目发布 8.5.12、8.4.27、8.3.36 和 8.2.35 安全版本，修复了两个可导致未认证远程代码执行的严重漏洞，并介绍了 PHP 安全流程的改进。

Two critical PHP zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4 and later are being exploited in the wild, prompting an emergency PHP release and outages across countless sites, with OpenAI and Wiz involved in the research and disclosure.

OpenAI's Greg Brockman announced the coalition-led mitigation of php2shell, a severe 14-year-old PHP vulnerability discovered using GPT-5.6 Sol, and outlined new approaches needed to secure the internet in the agentic AI era.

紧急修复的两个关键 PHP 漏洞影响自 2004 年以来的所有版本，可能导致大规模远程控制攻击，促使全球政府和企业网站紧急下线并抢在攻击前打补丁。

两个评分高达9.2/10的PHP远程代码执行漏洞（php2shell）被公开，官方已发布紧急补丁版本，要求所有PHP服务立即升级，否则可能遭遇在野利用。

OpenAI's Patch the Planet initiative helped researchers discover critical, internet-scale security vulnerabilities in PHP, coordinating a two-month disclosure process with maintainers to deliver fixes ahead of attackers and marking a new phase where frontier AI finds high-impact security bugs.

OpenAI led a coalition to disclose critical PHP vulnerabilities first discovered by GPT-5.6 Sol, sharing a PHP version checker and a proposed global response framework while committing $1B in subsidized Daybreak access for frontline defenders.

Retweeting Takaichi's urgent call about two critical security vulnerabilities in PHP, reminding website operators that widely use PHP to take immediate action tonight.

PHP 8.2.35 patch release announced for the PHP interpreter, with the php/php-src repository providing build, test, and installation instructions for the popular web scripting language.

Wiz Research 发现了 PHP 核心中一系列严重的内存安全漏洞，包括未经认证的远程代码执行，影响过去十年发布的几乎所有 PHP 版本（占全球 70% 网站），并借助前沿 AI 模型构建了复杂的利用链，促使 PHP 于 2026 年 10 月 21 日发布补丁。

荷兰国家网络安全中心（NCSC.nl）因 PHP 存在安全漏洞而临时将官网下线，PHP 安全团队预计于荷兰时间 16:00 发布补丁，NCSC 将在补丁发布一小时内发布安全公告，并在 GitHub 上持续更新受影响产品的技术信息。

A critical PHP vulnerability with a 9.2 severity score threatens to allow full server compromise, with fears that attackers will use AI to reverse-engineer the patch within 15 minutes of its release, alongside a publicly leaked exploit.

Two critical PHP Remote Code Execution vulnerabilities (9.2/10 severity, affecting PHP 5 onward) prompted emergency patches, with cybersecurity agencies advising unpatched sites to go offline. Over 1.3 million hosts and all WordPress sites are potentially affected, with experts anticipating mass attacks within minutes of the release.