Wiz CTO says PHP cleanup continues after critical bugs
Schwartz says AI tooling found bugs that sat in PHP for more than a decade, and some sites are still unpatched.
Stories per day · 30 days
2 RSS
Relatedphp11php2shell6remote-code-execution4wiz4openai3chainguard2chrome2claude2embargo2open-source2podcast2safari2vulnerability-disclosure2wordpress2android1anthropic1appsec1cna1
22 stories, newest first · one card per story
Stories tagged #coordinated-disclosure
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
Anthropic says Claude built critical exploit chains in Chrome, Safari and Android
Google assigned 62 critical or high Chrome CVEs, patched as of Chrome 156; Apple and Google say the Safari and Android issues are fixed.
FedTrust-CVDv2 ties vulnerability evidence to approved disclosure actions
A reference implementation accepted all 25 valid fixtures and rejected all 650 invalid fixtures.
PHP Foundation patches two critical unauthenticated RCE bugs, PHP2Shell
Calif's proof-of-concept shows unauthenticated remote code execution; mass exploitation is described as avoided so far.
3
PHP2Shell critical RCE bugs exploited as disclosure embargo collapsed
Cloudflare’s CEO said attempts reached millions after the October 21 release, which came 24 hours early.
Hacker News user apologizes for breaking PHP RCE embargo
The poster named CVE-2026-109618 and CVE-2026-109619 before coordinated disclosure, saying contacts denied any embargo.
OpenAI outlines a five-stage response plan for AI-found critical bugs
The plan follows a two-month PHP response in which Calif and Wiz independently found the flaws.
1
PHP says Chainguard broke embargo on critical PHP2shell bugs
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution, and at least one hits every PHP release back to 5.4.
GPT-5.6 Sol and Gemini 4 Argon found a critical PHP flaw
OpenAI says the models found the issues before attackers, and a GitHub tool checks whether a PHP version is affected.
PHP 8.x security updates fix two remote code execution flaws
Exploit notices circulated October 20 with a wrong CVSS of 10.0; the stated score is 9.2.
PHP says AI review revived critical bugs first flagged in 2024
Cloudflare saw exploitation attempts Wednesday, while the foundation says Chainguard published the fix before coordinated disclosure.
2
OpenAI coordinates fixes for critical PHP flaws found with GPT-5.6
Calif used GPT-5.6 Sol and Wiz independently reported both flaws; maintainers led the fixes and a version checker is available.
Firefox will keep security-fix tests private for a week after release
Sec-high and sec-moderate fixes must ship without tests until the Tuesday after a Tuesday release.
Talos says AI bug mining is flooding Microsoft Patch Tuesday
This month's 1,415 Microsoft advisories far exceed a pre-June average near 100, while exploited bugs rose more slowly.
3
Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026
Nix and Lix disclosed combinable flaws that can escalate local users to root via their daemons.
Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security
Anthropic launched unreviewed AI vulnerability reports for OSS maintainers and an OT security program with 11 firms.
Re: cloud computing provider disclosures
An oss-security reply says cloud providers' early fix access shortens disclosure windows and catches pre-release bugs.
After spending billions, OpenAI still has gaps in its cybersecurity
Hacktron accessed OpenAI employee accounts via chained flaws, and Accomplish escaped the Codex sandbox; both were fixed.
graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule
Unauthenticated quadratic CPU-exhaustion DoS disclosed in graphql-go/graphql up to v0.8.1 via OverlappingFieldsCanBeMergedRule; no fixed version exists.
GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline
GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.
11
ZDI-26-595: Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability
Foxit PDF Reader has a use-after-free vulnerability (CVE-2026-57254, CVSS 7.8) allowing remote code execution when a user opens a malicious file or page.