{
  "id": 16175669,
  "title": "cybersecurity firm Wiz said",
  "url": "https://urgent.news/2026/10/23/cybersecurity-firm-wiz-said",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-23T11:07:30.000Z",
  "source": {
    "name": "Rest of World",
    "slug": "restofworld",
    "url": "https://elink32b.restofworld.org/ss/c/u001.Xlw15BjkI5RzeMRrCnyxjkMpLkkThG1_r5Q2CS4ehSmxeS-W-nB_iubk1Sc8v5EUneMB7Onq7M6GBTNP7VKBUwq3m_J4AL8shdstgJ2xdjPwqlIPfcubWjMDlWbRUQB_QHqAYKxSbN4Pekrm5O0DvNe3Ej-w63D6V1uJQqtNqhd9RTLZ4hDivPIkK4sLO3Kmj4O5V1nLGvKQawqVXqiSiIZ01ySWoDG35O8kPhFSvTWTKMD5JDgEq0tCXBaujztKMFP2z5okAH4gueBWIAUnEEtrKXlh_8NOQ2XbePY7LKysfey5xE4kGT1iG1rr7haU/4v4/mDnpXwTcRKKBZklsXZpUIg/h13/h001.KT7h-YkiG1VqbgAUlJlqm0fl1eXzirZq4rJjcQf1Zrk"
  },
  "original_language": "en",
  "account": "Cybersecurity firm Wiz Research has identified multiple critical vulnerabilities in core PHP, a widely-used scripting language powering 70% of all websites globally. Successful exploitation could enable attackers to take control of affected servers, steal sensitive data, and deface websites. These vulnerabilities, including memory disclosure and unauthenticated remote code execution, affect every PHP version released in the last decade, dating back to version 5.4. On October 21, 2026, PHP addressed the issue with a patch. This ranks as one of the most severe vulnerabilities in PHP's history, with underlying flaws present for decades but recently discovered using advanced AI techniques. By leveraging frontier AI models, Wiz Research was able to identify and address these long-standing issues, which stem from key architecture decisions made over a decade ago. The vulnerabilities allow unauthenticated attackers to execute code on affected servers or read sensitive process memory, potentially exposing passwords, authentication tokens, API keys, and certificates. PHP, the backbone of many popular platforms like WordPress, Drupal, and Wikipedia's MediaWiki, poses a significant risk to the web ecosystem. The exploitation process required chaining multiple flaws and adapting to each target's memory layout. The vulnerabilities are memory-safety issues that arise from bugs in how PHP handles fatal errors during request processing. The PHP team, along with various other companies, has provided guidance and mitigations for customers who cannot immediately apply the patch.",
  "summary": null,
  "key_points": [
    "Wiz Research discovered critical PHP vulnerabilities",
    "Exploitation could lead to server control and data theft",
    "Patch released on October 21, 2026"
  ],
  "editors_take": "The discovery of these decade-old flaws through advanced AI highlights how frontier models can expose fundamental architectural weaknesses in the aging infrastructure that powers much of the modern web.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}