Post

🚨 The developers of PHP have just released new versions that patch two critical vulnerabilities that could allow remote code execution on any website running PHP (which is virtually all of them). www.php.net/archive/2026...

Wiz: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history." www.wiz.io/blog/php2she...

OpenAI, whose model helped researchers discover the vulnerabilities: "Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory." openai.com/index/coordi...

Today's xkcd: xkcd.com/3314/ Anyone curious about the story behind this comic won't be able to check explain xkcd today, because they took their website down due to the vulnerability: www.explainxkcd.com

Here, strangely delayed, is CISA's brief advisory about the PHP vulnerabilities: www.cisa.gov/news-events/...

Story updated with more detail, including Cisco's estimate that roughly half of PHP instances are too old to receive the security updates: www.cybersecuritydive.com/news/php-web...

White House statement: "This discovery demonstrates exactly why American leadership in [AI] is so critical. ... The Administration is tracking and coordinating with federal agencies and leading [AI] labs to expedite the release of the fix and protect American networks and critical infrastructure."