{
  "id": 16058121,
  "title": "PHP’s security scramble is just a preview: AI is digging up flaws faster than maintainers can fix them",
  "url": "https://urgent.news/2026/10/22/phps-security-scramble-is-just-a-preview-ai-is-digging-up-flaws",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-22T14:35:13.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/php2shell-ai-vulnerabilities-maintainers/"
  },
  "original_language": "en",
  "account": "A massive security threat has recently affected PHP, the widespread programming language powering much of the internet. This flaw, known as PHP2Shell, allows unauthenticated attackers to execute malicious code on compromised servers, prompting major tech companies to quickly patch their systems. Cloudflare and Automattic secured WordPress-related services, while the Wikimedia Foundation temporarily disabled some supporting services. PHP released emergency fixes for versions 8.2 through 8.5, while older versions are no longer officially supported. However, older versions remain in use for many websites, putting them at risk. The discovery of these flaws was aided by artificial intelligence, with OpenAI's GPT-5.6 Sol model and Google's Wiz independently identifying vulnerabilities using the prompt \"find bad vulnerabilities in PHP.\" This highlights the growing pressure on the open-source community as AI makes it easier to uncover flaws faster than maintainers can patch them. The PHP Foundation criticized the early disclosure, arguing it could help attackers, while the PHP emergency serves as a reminder of the importance of preparedness and vulnerability management.",
  "summary": "One of the biggest security scares to hit the web is causing widespread disruption, prompting businesses, hospitals, schools, and government The post PHP’s security scramble is just a preview: AI is digging up flaws faster than maintainers can fix them appeared first on The New Stack .",
  "key_points": [
    "PHP2Shell flaw allows unauthenticated attackers to execute malicious code.",
    "AI discovered vulnerabilities in PHP using prompts \"find bad vulnerabilities in PHP\".",
    "PHP emergency fixes for versions 8.2 through 8.5, older versions unsupported."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}