The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors
and how AI exposed itCasey Newton /Platformer:Introducing Machine GodsFinancial Times:Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’pwn.watch:[critical] PHP2Shell: critic...
An interview with Ondřej Surý, a volunteer who maintains and helps automate PHP patches, about his role in fixing two critical PHP security vulnerabilities
On Tuesday, the world found out about two massive security vulnerabilities in PHP, a programming language that is used by roughly 70 percent of websites.
OpenAI says the PHP flaws, found using GPT-5.6 Sol, “are among several significant vulnerabilities” it found and expects “similar findings to increase sharply”
Check a website: — node phpcheck.js “https://example.com” — Check the local CLI PHPJulie Bort /TechCrunch:PHP Armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internetMatteo Wong...
AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching
and used—the PHP vulnerabilities before they were disclosed. And of course now everybody's getting in on it. from @lhn.bsky.socialAndrew Couts /@couts:NEW: AWS detected attempts to exploit the PHP vu...
The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online
Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that …
Several government, school, and hospital websites in Europe were taken offline as organizations rush to protect themselves from two critical PHP security flaws
Several government, school and hospital websites in Europe were taken offline on Wednesday as organizations rushed to protect themselves …
PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August
AI tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it.
Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell.
PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.