PHP Releases Emergency Updates for Two Critical Vulnerabilities Discovered by AI
PHP has issued emergency updates for two vulnerabilities rated 9.2 in severity that allow unauthenticated code execution, discovered with the help of AI models, prompting alerts from cybersecurity agencies.
The programming language "PHP" has released emergency updates for two security vulnerabilities designated "CVE-2026-109618" and "CVE-2026-109619", with a severity score of 9.2, allowing unauthenticated code execution, according to a report by "The Next Web".
According to the report, "Calif" discovered one of the vulnerabilities with the assistance of OpenAI's "GPT-5.6 Sol" model, while the company "Wiz" independently found both vulnerabilities using "Gemini 4 Argon" and "GPT-5.6 Sol".
CERT-EU, the UK's National Cyber Security Centre, and the US National Security Agency issued alerts regarding the two vulnerabilities, at a time when some websites announced they were going offline.
Versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 patched the two vulnerabilities, making an urgent update necessary for servers running the language.
What Do These Terms Mean?
Remote Code Execution (RCE): A vulnerability that allows an attacker to run software commands on a victim's server over a network without authorization.
Memory Safety: A property of a program that prevents access to memory areas not allocated to it, the absence of which opens the door to executing malicious code.
CVE Identifier: A unique number assigned by a public database to each known security vulnerability to facilitate tracking and patching it.
Severity Score: A scale from 0 to 10 assessing the severity, ease of exploitation, and impact of a vulnerability, with scores above 9 considered critical.
Weekly Newsletter
Read between the lines before everyone else. Decode the most important economic, tech, and decision-maker movements in the region.. in 5 minutes every Saturday.
