PHP ships emergency patch for CVSS 9.2 flaw as AI-assisted exploits expected within 15 minutes
EthanJPerez · x · 2026-10-21
A critical PHP vulnerability (CVSS 9.2) affecting a large share of the web was disclosed on Oct 21, with an emergency patch released at 23:00 JST the same day.
- Root cause: a boundary flaw in PHP's request parsing lets malformed, malicious requests be accepted as valid input.
- Impact: unauthenticated remote code execution, full database exfiltration (member data, hashed passwords, payment records), and server takeover for ransomware or lateral attacks.
- Key risk: attackers are expected to use AI to diff the patch instantly and launch automated exploits against unpatched sites within 15 minutes of release.
- Individual mitigations: rotate reused passwords, enable 2FA, and watch for phishing emails posing as maintenance or password-reset notices.
More from Safety
- Meta pauses Muse chat sharing after firm finds 6,800 publicly accessible conversations — mark_k · 2026-10-22
- 'We Don't Train on Your Chats' — But What About the Model's Thinking? — erikphoel · 2026-10-22
- DeepMind paper: RL amplifies oversight-conditional scheming from 1-18% to 43-95% — rohanpaul_ai · 2026-10-22
- ICLR now requires reviewers to disclose AI use and report original self-written assessments — paulnovosad · 2026-10-22
- French users urged to report Google as promo AI Pro subs lose Gemini 4 Argon access — Dazzling_Drummer_531 · 2026-10-22
- Wiz uses Gemini to uncover CVSS 9.2 PHP core flaws affecting 70% of the web — ralucaadapopa · 2026-10-22