PHP fixes two high-severity vulnerabilities affecting 70% of websites, PHP2Shell
PHP maintainers have released patches for two high-severity vulnerabilities collectively known as PHP2Shell, which they say affect up to 70% of websites worldwide and could allow attackers to deploy malicious code on servers. Cloudflare and Fastly said they have observed active exploitation attempts, and security agencies including the NSA recommend that organizations shut down affected systems while patching. The underlying technical issue has existed in PHP for decades; in August of this year, an employee at a security firm used GPT-5.6 Sol to scan the PHP codebase and found it could be exploited in practice, after which Google's Wiz team added to the findings. An industry joint group had planned to release the patch on Thursday, but moved it up to today after the vulnerability leaked on a developer forum yesterday.
#Safety / alignment#Open-source ecosystem#OpenAI