Two PHP core bugs allow unauthenticated RCE, and AI is wrecking responsible disclosure
unixterminal · x · 2026-10-23
Two PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both allow unauthenticated RCE: one leaves partially initialized request data that shutdown handlers treat as valid, the other leaves stale pointers in global state after the request heap is freed, hitting later requests on the same worker. PHP urges all installations to update, yet researchers found the PoC still works post-patch.
The author's bigger concern is disclosure culture: after Calif posted a PoC video, crowds prompted LLMs to hunt exploits with zero context, producing thousands of broken exploits and hours of needless panic. The original research is attributed to Ryan Austin (lcfrhax) via an OpenAI 'Patch the Planet' engagement.
Related event: Critical PHP RCE Flaws Leaked, Sparking Mass Scanning and Attacks(4 posts)→
More from Safety
- Theorem Labs formally verified 123 open-source projects with Claude, launches OSS Verify — teortaxesTex · 2026-10-23
- Anthropic used Claude to prove 123 OSS libraries crash-free, with 180M lines of Rocq proofs — inductionheads · 2026-10-23
- Viral cartoon: humans must show 'proof of human' to survive a web of synthetic content — sierracatalina · 2026-10-23
- Researchers call for anti-shredding provisions as AI firms use self-destructing messages — StephenLCasper · 2026-10-23
- 20+ ICLR 2027 submissions self-confess fabricated placeholder results — thegautamkamath · 2026-10-23
- Fired OpenAI safety researchers tell their side in first podcast interview — kevinroose · 2026-10-23