CONNECT WITH US
AI & Deeptech

AI & Deeptech

AI found a critical PHP flaw. The bigger failure began in 2024.

TheNewStack (AI) - ArtificialIntelligence logo

Published on

Add as a preferred source on Google
AI found a critical PHP flaw. The bigger failure began in 2024.

Did one of your favorite websites go dark on Wednesday? Some did, as operators took services offline while they waited for fixes to two critical flaws in PHP, the language behind much of the web.

The precaution didn’t mean those sites were hacked. The holes themselves were bad news with a capital B. But the bigger long-term concern might be how the embargo on the patches was handled.

PHP powers roughly 70% of websites, but that figure describes PHP’s reach, not the number of vulnerable or compromised sites. 

WordPress told site owners to update PHP; these flaws don’t require a WordPress update. 

The flaws are CVE-2026-109618 and CVE-2026-109619. The PHP project’s fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; users of older PHP branches need a supported upgrade or a distributor’s backport.

The PHP security emergency, aka PHP2Shell, exposed more than dangerous bugs in a widely used language. The release also set off a dispute over coordinated disclosure and underscored the pressure on open-source maintainers as AI-assisted researchers find and develop exploits faster.

The road to this emergency ran through OpenAI’s Patch the Planet initiative. 6 Sol to find a route to remote code execution and reported it to PHP on August 11. OpenAI independently reported the same underlying issue that day; Wiz reported its findings on August 24. PHP’s maintainers led the fixes. They had spotted signs of the underlying out-of-memory problem in 2024, but its full impact became clear only this August.



Source link
Related Topics:AI & Deeptech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.