AI models find two CVSS 9.2 critical bugs in PHP, which powers ~70% of the web; emergency patch follows
ziv_ravid · x · 2026-10-22
AI models just surfaced two critical vulnerabilities (CVSS 9.2) in PHP — the backbone of roughly 70% of the web — and an emergency patch followed.
Ziv Ravid draws three takeaways in a thread:
- Get used to this headline: agents finding vulnerabilities is the new normal.
- Dual use: agents will keep hunting bugs for both offense and defense; many attempts, a few successes, lots of scary headlines.
- Cyber has always been an offense/defense arms race — the scale and capability of the models are what's new.
He argues plurality is what saves us: open models will be a central pillar of defense, scanning everything alongside paid frontier models and dedicated security companies — and he predicts OpenAI/Anthropic will try and fail to dominate this space.
More from Models
- Ant's Ling-3.1-flash-1019 jumps to 44 on Intelligence Index, agent scores improve sharply — Med1_Ai · 2026-10-22
- Physics benchmark CritPt v2 launches: GPT-6 Astra leads at 83.1% accuracy — OfirPress · 2026-10-22
- Iron Dome meme: 'obliterated Chinese models' that just keep coming — burny_tech · 2026-10-22
- Kapitsa engine hits 97 tok/s on Qwen3.5 4B in benchmarks on a 2021 M1 Pro MacBook with 16GB — DotaMate · 2026-10-22
- DeepSeek V4.1 Flash fails image hidden-message puzzle after 70+ steps, rivals solve it with hints — teortaxesTex · 2026-10-22
- Fable-5.1 can hide secret messages in benign images — and its twin decodes them unprompted — teortaxesTex · 2026-10-22