vulnerability

Two severe vulnerabilities disclosed in PHP affect nearly 20 years of versions, knocking major sites like Wikipedia, WordPress-backed platforms, Internet Archive, and Cloudflare-protected services offline and forcing some old Japanese mobile games to permanently shut down.

AI tools from OpenAI and Google's Wiz uncovered two critical vulnerabilities in PHP affecting roughly 70% of websites, prompting emergency patches and widespread site shutdowns including parts of Wikipedia and over 200 Japanese organizations.

Amazon Threat Intelligence 通过 MadPot 蜜罐在 CVE-2026-109618/109619 公开披露前四天（10月17日）就发现了 PHP2Shell 漏洞利用尝试，且 AI 辅助分析正显著缩短从补丁发布到可用漏洞利用的时间。

A Hacker News poster apologizes for unknowingly breaking the embargo on two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), disrupting the coordinated disclosure schedule.

Four major cybersecurity incidents came to light in less than 24 hours: a high-severity remote code execution vulnerability that had remained hidden in PHP for 14 years (discovered using AI in an OpenAI-led effort, with a patch already released); Node.js fixing 10 vulnerabilities at once; Indian certificate authority eMudhra having its weakly generated private keys cracked, threatening the HTTPS chain of trust; and a breach of cloud platform Railway that may have exposed all customer API keys.

A tweet lamenting that today was the worst day in the history of internet security: PHP dropped two critical vulnerabilities on the same day, allowing attackers to execute code remotely without logging in, and details leaked before patches were even released, affecting major systems such as WordPress, MediaWiki, Magento, Joomla, and Laravel. The author faithfully translated the original post into Chinese, preserving its style.

The author argues that the latest high-profile PHP vulnerability is far less exploitable than Log4Shell or Heartbleed, and that the thousands of circulating 'PoC' exploits are largely broken artifacts generated by LLMs that modify test environments instead of chaining the real bug.

FoxIO researchers disclosed QPACK amplification attacks against HTTP/3 servers, where a small HEADERS frame can force servers to allocate 10x-1000x more memory, enabling OOM/DoS with a single connection. Seven of ten tested implementations were vulnerable, including quic-go, quiche, lsquic, Bun, and Wireshark, with several already patched and others still unpatched.

CZ warns users to be cautious browsing the web after two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting WordPress and Magento servers were exploited in the wild following an early leak, prompting patches and WAF protections.

Two critical PHP vulnerabilities—discovered with the help of AI models like GPT-5.6 Sol—caused widespread site outages across the internet, affecting 4chan, Wikipedia, DeviantArt, government agencies, and Pokémon services.

GitLab 发布关键补丁版本，修复 CVSS 10.0 的未认证远程代码执行漏洞（CVE-2026-110264），该漏洞源于正则表达式编译器中的整数溢出，影响 7.0 至 19.5 的多个版本。

A potential third critical PHP CVE is surfacing, raising fresh security concerns for web developers and servers relying on the popular scripting language.

OpenAI's Patch the Planet initiative and Google's Wiz used AI models like GPT-5.6 Sol and Gemini 4 Argon to uncover two critical, decades-old PHP vulnerabilities present since 2004, prompting an NSA warning and urgent patches from the PHP Foundation for the ~70% of websites running PHP.

A newly disclosed vulnerability, CVE-2026-107891, reveals multiple integer overflows in musl libc's regcomp that can lead to incorrect allocation sizes and out-of-bounds heap writes, disclosed via the Openwall oss-security mailing list.

Two critical PHP runtime vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed php2shell) that had existed for over a decade were demonstrated as exploitable with the help of frontier AI models, prompting a coordinated defense across the web including pre-disclosure Cloudflare WAF protections.

Two critical PHP zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4 and later are being exploited in the wild, prompting an emergency PHP release and outages across countless sites, with OpenAI and Wiz involved in the research and disclosure.

OpenAI's Greg Brockman announced the coalition-led mitigation of php2shell, a severe 14-year-old PHP vulnerability discovered using GPT-5.6 Sol, and outlined new approaches needed to secure the internet in the agentic AI era.

Retweeting Takaichi's urgent call about two critical security vulnerabilities in PHP, reminding website operators that widely use PHP to take immediate action tonight.

Wiz Research 发现了 PHP 核心中一系列严重的内存安全漏洞，包括未经认证的远程代码执行，影响过去十年发布的几乎所有 PHP 版本（占全球 70% 网站），并借助前沿 AI 模型构建了复杂的利用链，促使 PHP 于 2026 年 10 月 21 日发布补丁。

荷兰国家网络安全中心（NCSC.nl）因 PHP 存在安全漏洞而临时将官网下线，PHP 安全团队预计于荷兰时间 16:00 发布补丁，NCSC 将在补丁发布一小时内发布安全公告，并在 GitHub 上持续更新受影响产品的技术信息。