Wiz CTO discusses PHP critical-bug cleanup on Equity podcast
Schwartz says he joined OpenAI, Calif and the PHP team after two critical bugs forced some sites offline.
30
- Mentions · 7d6
- Mentions · 30d28
- All mentions34
- First seenAug 15, 2026
- Last mentioned2d ago
Timeline
34 articles · newest firstWiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
32
PHP2Shell cleanup will lag exploitation; Token Security argues identity limits matter more than CVSS
Censys counted 32.5 million internet-facing PHP services on vulnerable versions a week after patching, and CISA added both flaws to its KEV list on October 26.
30
CISA says attackers are exploiting critical PHP2Shell bugs
US civilian federal agencies have three days to patch passwordless remote break-ins in widely used PHP.
86
PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
78
PHP2Shell drew millions of exploit attempts; none succeeded, foundation says
Cloudflare saw millions of attempts within hours, while Calif, OpenAI and Wiz say AI helped turn long-known PHP issues into practical exploits.
62
Essay says AI shrank PHP2Shell exploit time to hours
The author says CVE-2026-109618 and CVE-2026-109619 were exploited before the delayed patch, after leaks broke the embargo.
34
PHP2Shell critical RCE bugs exploited as disclosure embargo collapsed
Cloudflare’s CEO said attempts reached millions after the October 21 release, which came 24 hours early.
88
PHP2Shell flaws can give unauthenticated control of website servers
Calif and Wiz found the bugs; OpenAI helped PHP develop patches, and the NSA urged taking unpatched systems offline.
90
Critical PHP flaws prompt site shutdowns as exploit attempts surge
watchTowr says both bugs are remote code execution from PHP 5 onward and were rated 9.2 of 10.
90
Amazon says PHP2Shell was probed before disclosure and is now exploited
Fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12; PHP 8.1 and earlier get no official patches.
92
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
90
OpenAI outlines a five-stage response plan for AI-found critical bugs
The plan follows a two-month PHP response in which Calif and Wiz independently found the flaws.
52
PHP says Chainguard broke embargo on critical PHP2shell bugs
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and at least one hits every PHP release back to 5.4.
88
PHP patches two critical unauthenticated RCE flaws
CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.
88
NSA warns of two critical PHP flaws present since version 5
OpenAI and Wiz say the holes were found before attackers; unpatched sites should go offline, and PHP 8.5.12 is recommended.
82
PHP patches two critical remote code execution flaws
Unauthenticated code execution was demonstrated on Apache with mod_php under default settings for the memory bug.
82
Critical PHP flaws let unauthenticated attackers run code on web servers
CVE-2026-109618 and CVE-2026-109619 score 9.2; only PHP 8.2 and newer get official patches, and Cloudflare reported early attacks.
90
Patchstack and Cloudflare report early PHP2Shell exploitation
Fixed builds are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; reporting does not confirm how widely attacks succeeded.
88
OpenBSD 7.9 local root exploit chains old BSD bug with kernel flaw
Calif’s public chain bypasses KARL, SMAP, and SMEP; OpenBSD patched both issues in September via syspatch.
68
OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root
Researchers published a local OpenBSD kernel exploit chaining a decades-old shared-memory bug with an out-of-bounds write to gain root.
62
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
Researchers published a local OpenBSD 7.9 root exploit chaining a 1988 shared-memory bug with a kernel use-after-free.
61
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
Calif details a patched OpenBSD local-root bug tracing to a 37-year-old shared-memory counter.
58
Researchers Demonstrate iOS 27.0.1 Untethered Jailbreak on iPhone 18 Pro
Researchers showed an untethered iOS 27.0.1 jailbreak on an iPhone 18 Pro at Hexacon.
74
37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released
Researchers released a patched OpenBSD local root exploit chaining a 37-year-old shared-memory bug.
62
CVE-2026-86950: The Great Glyph Grift - An in-the-wild iOS bug with a possible WhatsApp zero-click path
Apple fixed in-the-wild CoreGraphics CVE-2026-86950 in iOS 26.7.1; crafted PDF fonts can trigger an out-of-bounds write.
86
Public PoC Released for Apple CoreGraphics Zero-Day CVE-2026-86950
Public crash PoC released for Apple CoreGraphics zero-day CVE-2026-86950, reportedly used in targeted attacks.
82
Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
Researchers published a crash-only PoC for Apple CoreGraphics CVE-2026-86950, which CISA listed as exploited.
86
Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls
Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.
62
WeChat worm could pwn a friend before they even answered the call
Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.
68
WeChat Worm Can Hijack Accounts Without Victims Answering Calls
Researchers demoed WeWorm, a zero-click WeChat worm hijacking accounts via incoming VoIP calls using a memory corruption flaw; Tencent patched it in August.
66
“Zero-click” WeChat worm could hijack accounts and spread via a single call
Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.
82
Apple macOS Screen Sharing Flaw Exploited on Internet
Actively exploited CVE-2026-65400 in macOS Screen Sharing grants pre-auth root access; attackers deploy Monero miners on exposed systems.
82
macOS Screen Sharing Flaw Exploited to Deploy Monero Miners
Dutch NCSC confirms active exploitation of critical macOS Screen Sharing flaw CVE-2026-65400, granting root access and installing Monero miners.
80
Related CVEs
by mentions- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-8695026%8.8Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS
- CVE-2026-654002%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-43779<1%9.8A logic issue was addressed with improved restrictions
- CVE-2026-43760<1%8.6An access issue was addressed with improved access restrictions
- CVE-2026-43777<1%7.5This issue was addressed with improved input validation
Appears with
- Wizorganization · 16
- OpenAIorganization · 13
- PHPproduct · 11
- PHPvendor · 8
- PHP Foundationorganization · 7
- Applevendor · 6
- WordPressproduct · 6
- Cloudflareorganization · 6
- macOSproduct · 5
- GPT-5.6 Solai model · 5
- Tencentvendor · 4
- watchTowrorganization · 4
- CISAorganization · 4
- iOSproduct · 4
- NSAorganization · 4
- OpenBSDproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.