Calif publishes two PHP remote vulnerabilities as a comic, covered by WSJ and NYT
thomasahle · x · 2026-10-22
Calif Research released a comic-style write-up of two PHP remote vulnerabilities (CVE-2026-109618, CVE-2026-109619), discovered jointly by Calif, OpenAI and Wiz and patched in PHP's October 2026 security release. The story was covered by The Wall Street Journal and The New York Times.
The write-up traces a history from Stefan Esser's 2004 discovery of the first PHP memory-limit RCE (kept private, with only CORE and Immunity holding non-public exploits), through a seemingly harmless 2020 OOM bug report, to a 2024 audit uncovering a related OOM exploitation path that culminated in this RCE chain.
Related event: AI Helps Uncover Critical PHP Flaws Affecting 70% of Websites(96 posts)→
More from Safety
- Anthropic's RSP bars external evaluators with close personal ties to anyone at the company — morqon · 2026-10-22
- London AO Summit expands lineup with DeepMind, ARIA speakers on autonomous organizations — weballergy · 2026-10-22
- Internet Freedom Foundation slams CERT-In for vague, alarming botnet warning SMS campaign — kingslyj · 2026-10-22
- US announces $389M investment in advanced chips for fusion, AI data centers — Polymarket · 2026-10-22
- DeepSeek V4.1 Flash Finds CVEs at $2.40 Each, 27x Cheaper Than Opus 5 — teortaxesTex · 2026-10-22
- eMudhra exits CA business amid trust concerns, dubbed a face-saving move — basedjensen · 2026-10-22