Wiz uses Gemini to uncover CVSS 9.2 PHP core flaws affecting 70% of the web
ralucaadapopa · x · 2026-10-22
Wiz Research disclosed PHP2Shell, a set of critical memory-safety vulnerabilities in the PHP core engine (CVSS 9.2), enabling memory disclosure and unauthenticated RCE across the ecosystem powering 70% of all websites — WordPress, Drupal, MediaWiki and more. Every PHP release since 5.4 is affected by at least one flaw; patches shipped October 21, 2026.
The key twist: the flaws had existed for decades, but proving exploitability required an exploit chain at the edge of human capability. Frontier AI — Gemini 4 Argon — found the vulnerabilities, built the complex exploit chain, created attack detectors and validated the patch, substantially lowering the barrier to turning long-standing bugs into working exploits.
More from Models
- One researcher pretrains coding model Mirendil-Base in 3.5 months for under $10M — bneyshabur · 2026-10-22
- OpenAI models now on Azure and AWS, coming soon to Google Cloud — romainhuet · 2026-10-22
- Flint cuts bike-demand validation RMSLE 30.8% in 3 hours of autonomous model iteration — cong_ml · 2026-10-22
- Running an autonomous research loop locally with Recursive Flint, from scheduling to bike-demand forecasting — cong_ml · 2026-10-22
- Developer calls out Grok's context bloat: no trimming, no window awareness — alexcovo_eth · 2026-10-22
- Grok's in-tweet chat takes ~20s to first token, dev says Google AI search is faster — BraceSproul · 2026-10-22