PHP ships emergency patches for two RCE holes after coordinated-disclosure leak
Simon Willison · rss · 2026-10-22
Simon Willison recaps the PHP security release: patches across the entire PHP 8.x line fix two remote code execution holes, with exploits circulating since last night after a coordinated-disclosure leak. Timeline: Wiz Research discovered the flaws in August using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, confirmed unauthenticated RCE against Drupal and WordPress, and responsibly reported to PHP. On Oct 20 the CVE IDs leaked with a wrong CVSS 10.0 score, PHP moved its pre-announcement up, and security firm Calif mistakenly published a PoC video that accelerated further exploit development. AI-assisted vulnerability discovery is a notable angle.
More from Safety
- PHP Foundation timeline shows Calif, OpenAI, and Wiz all reported the same RCE — basedjensen · 2026-10-22
- Researcher warns GitLab flaw is 'really bad,' urges users to patch now — basedjensen · 2026-10-22
- RCE free-for-all feels like 2000 again, vet says, pointing to PHP2Shell race bugs — moyix · 2026-10-22
- Microsoft: Storm-0940 used agentic AI framework ARTEX to attack hundreds of orgs — basedjensen · 2026-10-22
- Amid rising cyberattacks, a 6-step personal security checklist worth doing today — peterwildeford · 2026-10-22
- GPT-5.6 Sol and Gemini 4 Argon both found a critical PHP flaw affecting millions of sites — The Decoder · 2026-10-22