AI Found Decade-Old Flaws in PHP, the Code Behind Most of the Web, and the Patch Race Is On

Unable to add items

Sorry, we're unable to add the item because your cart is already full.

Add to basket failed.

Please try again later

Add to wishlist failed.

Please try again later

Failed to remove from Wish List.

Please try again later

Adding to library failed

Please try again

Unable to follow podcast

Unable to unfollow podcast

AI Found Decade-Old Flaws in PHP, the Code Behind Most of the Web, and the Patch Race Is On

Listen for free

View show details

Season's Savings | 0.99 €/month for 3 months

5.99 €/month thereafter - terms apply. Cancel monthly.

PHP shipped emergency fixes on October 21 for two critical core-engine flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, which allow unauthenticated remote code execution and memory disclosure across PHP versions 5.4 through 8.5.11. The bugs had been present for over a decade and were found with help from frontier AI: Calif used OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet effort, while Wiz independently found both with help from Google's Gemini 4 Argon. CISA urged immediate patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and OpenAI warned that similar AI-driven findings are expected to increase sharply in the coming months.

No reviews yet