Two critical vulnerabilities in PHP. Remote code execution without login or user interaction.

[william]

According to the BSI, potentially all versions from PHP 5 are affected, that's twenty years of code. The BSI rates the situation as critical. And on the same day, Node.js patched ten vulnerabilities, four of them critical, as well as Go.

Now the part that hardly anyone is talking about.The vulnerabilities had been undetected in the code for over a decade. They were found by OpenAI's GPT-5.6 Sol (!!!). Wiz calls them the most severe vulnerabilities ever discovered with this technology.

The White House knew about it since Friday, October 16. OpenAI coordinated the disclosure with CISA and the Office of the National Cyber Director. Five days in which a government knew that three-quarters of the internet was wide open, and the others didn't. In the end, it leaked prematurely, which is why EMERGENCY MODE now.This is exactly where it shows what it practically means not to have your own models - What I've been warning about for years now!This time it ended well. But anyone in Europe who doesn't prepare for very dark times now is skating on thin ice.

https://twitter.com/x/status/2112989031965351988

Version 1.1: PHP - Kritische Schwachstellen bedrohen Webanwendungen weltweit

In einer Vorab-Ankündigung informieren die Entwickler von PHP aktuell über die Veröffentlichung von Details und Patches zu zwei Schwachstellen in der Programmiersprache am 21. Oktober 2026 ab 16 Uhr. Auch wenn zum aktuellen Zeitpunkt nur wenige Details verfügbar sind, legen die Bewertungen nach...

www.bsi.bund.de

Two critical vulnerabilities in PHP. Remote code execution without login or user interaction. - Bing

Intelligent search from Bing makes it easier to quickly find what you’re looking for and rewards you.

www.bing.com