AI finds critical PHP server-takeover bug exposing ~70% of websites
scottleibrand · x · 2026-10-22
- WSJ exclusive: AI systems found one of the most severe server-takeover bugs in recent memory in PHP, discovered using OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon plus human expertise.
- PHP powers 70% of websites including WordPress; the bugs sit in PHP itself, so nearly every PHP site is exposed regardless of its own code quality.
- No-login attackers can execute code or read memory (passwords, session tokens, API keys). Root cause: corrupted state left after a request crashes on memory exhaustion — attacker-triggerable via crafted upload, so even a bare page on a vulnerable server is an entry point.
More from Safety
- Claude Security goes continuous: scans code as it changes, has found 1M+ vulnerabilities — rohanpaul_ai · 2026-10-22
- Veracode report: AI now writes half of committed code but only 56% pass security checks — WeldPond · 2026-10-22
- Researcher Warns AI Cyberattacks on Grid Possible Within a Year, Shares Prep List — cephaloform · 2026-10-22
- New preprint shows LLMs form hidden beliefs about users that affect refusals — zeynepakata · 2026-10-22
- OpenAI expands AI cybersecurity push, hiring a DX engineer for its Cyber team — romainhuet · 2026-10-22
- AIandDesign shares notes on the recent wave of alarming AI cybersecurity incidents — AIandDesign · 2026-10-22