THE HOOK
Frontier AI just turned two decade-old PHP bugs into working server takeovers, and roughly 70% of the web runs on PHP.
THE GIST
PHP shipped fixes on 21 October for two remote code execution flaws, rated up to 9.2, that hit every version back to 5.4. Wiz Research chained them into unauthenticated attacks on WordPress, Drupal and Joomla using Gemini 4 Argon and GPT-5.6 Sol.
THE TAKE
This is the moment the AI security pitch stopped being a slide deck: the bugs were known in theory, but nobody could practically exploit them until models did the grunt work. Defenders got there first this time, and next time it might be a ransomware crew with the same API key. Patch windows just shrank to days.
OPINION
OpenAI's response is a five-stage coordinated disclosure plan that pulled in hosts, CDNs and government responders before going public, and it warns findings like this will rise sharply. Sensible, but it quietly admits the old 90-day disclosure clock is dead when a model can weaponise a patch diff overnight.
- Story type: Breaking news
- Impact: High
- Confidence: High (official announcement)
- Audience: Developers
- What changed: PHP patched two critical RCE flaws that frontier AI models helped find and exploit.
- What to watch: Whether in-the-wild exploitation starts before hosts finish patching older PHP versions.
- Reading time: 1 minute
