Critical unauthenticated PHP flaws (CVSS 9.2) found with AI and patched; NSA urges patching; Brazil, France take sites offline
Matéria consolidada. Reúne 7 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 24/10/2026 00:04; os links antigos trazem para cá.
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each flaw is rated CVSS 9.2 and allows unauthenticated remote code execution, according to CERT-EU (olhardigital.com.br). One was reported by Calif with OpenAI and the other by Wiz, both using AI models. The PHP Foundation confirmed that the first signs of the flaws date to a 2024 external audit by Quarkslab, and that the fix stalled and restarted repeatedly (olhardigital.com.br). Exploitation status is disputed: the earlier report said none had been observed (techcrunch.com), while a later report cites first attacks from Cloudflare's CTO, which CISA had not confirmed (olhardigital.com.br). Governments and companies have reportedly taken sites offline as a precaution since 21 October (olhardigital.com.br). On 22 October 2026 the impact became concrete in Brazil: Anatel and the federal courts TRF1, TRF4 and TRF6 suspended external access to systems including the Sistema Eletrônico de Informações (SEI), after an alert from the Brazilian CISC on 21 October. GSI told federal IT managers to update immediately and MGI told federal teams to temporarily take PHP-based systems offline. The Brazilian federal government's alert urged public bodies to update the software (olhardigital.com.br). A 23 October article reports no major impact in Brazil so far (olhardigital.com.br). French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency (olhardigital.com.br).
Entenda a falha
A vulnerabilidade
Two critical flaws in PHP itself, present in every version since PHP 5 (2004). CERT-EU rates each CVSS 9.2 and describes unauthenticated remote code execution: no account or password is needed, only network reach to a vulnerable server. The NSA describes the outcome as access to the server file system or the web application's database. Possible results include data theft, defacement or full takeover. The articles give no CVE IDs and do not name the vulnerable component. The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. PHP 8.1 and older are unsupported, so those sites must be upgraded. WordPress says the issue is not specific to it.
Como funciona
The articles do not describe the technical mechanism. They say only that a remote attacker can run code on a vulnerable PHP server without credentials. Which input reaches which part of PHP, and at which step it goes wrong, is not stated. Wiz says LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts, which suggests exploitation depends on those factors. The articles do not detail this.
Por que é vulnerável
The root cause is not described in the articles, and neither is what the patch changes. They explain why the flaws lasted so long. In 2024 no remote command execution method was known, the security team struggled to make decisions, and few developers know PHP internals. The PHP Foundation also said PHP security depends on a small group of funded and volunteer developers and called the delay a structural process failure. Wiz said the flaws went unanswered for over a decade because finding and exploiting them was very complex without AI.
Como foi descoberta
The PHP Foundation says the first signs date to a 2024 external audit by Quarkslab, and the fix stalled and restarted several times. Calif, working with OpenAI under the Patch the Planet initiative and using GPT-5.6 Sol, reported one flaw on 11 August 2026. Wiz reported a second on 24 August, using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Later articles say Calif and OpenAI found the flaws independently and Wiz found further ways to exploit them; the sources do not reconcile this. TechCrunch says both followed coordinated disclosure, worked with PHP on patches and had vendors such as Cloudflare and Microsoft validate them. Patches and advisories came on 21 October. Exploitation is disputed: Cloudflare's CTO reportedly saw the first attacks, but CISA said it had not observed any.
Explicação gerada por IA a partir da matéria e dos artigos, em 24/10/2026 00:19.
Detalhes técnicos
- Impact: CERT-EU confirms remote code execution without authentication or an account. Possible outcomes are data theft, web page defacement or full system compromise (olhardigital.com.br). Later reports add that the flaws allow actions on servers without credentials, which can lead to full server takeover (olhardigital.com.br).
- Discovery by Calif: The firm found one flaw under OpenAI's "Patch the Planet" initiative with GPT-5.6 Sol (techcrunch.com). It reported the flaw on 11 August (olhardigital.com.br). Later articles say Calif and OpenAI discovered and reported the flaws independently in August 2026 (olhardigital.com.br).
- Discovery by Wiz: The firm found multiple PHP vulnerabilities with its Wiz Atlas AI agent, Gemini 4 Argon and GPT-5.6 Sol (techcrunch.com). It reported a second flaw on 24 August (olhardigital.com.br). The later articles say Wiz found further ways to exploit the flaws using Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI). Wiz called them among the most serious PHP vulnerabilities ever found, possibly in software history, and said they went unanswered for over a decade because discovery and exploitation were complex without AI (olhardigital.com.br).
- Earlier identification: The first signs of the flaws date to a 2024 external audit by Quarkslab (olhardigital.com.br). The fix stalled and restarted repeatedly because of limited resources and decision-making difficulties in the security team. The delay was also attributed to the lack of a known remote command execution method at the time and a shortage of experts who know PHP internals. The Foundation called the delay a structural process failure (olhardigital.com.br).
- AI use by the PHP Foundation: It uses AI tools such as Claude Mythos to analyze code and triage reports, but says they cannot determine the best way to structure a fix (olhardigital.com.br).
- Exploitability: The flaws were previously considered too hard to exploit. Wiz warns that LLMs can now help adapt exploits to different PHP versions, configurations and memory layouts (techcrunch.com).
- Reach: PHP powers roughly 70% of websites (over 33 million sites) and underpins CMSes such as WordPress (techcrunch.com), and platforms such as Moodle and Magento (olhardigital.com.br). WordPress says the issue is not WordPress-specific (techcrunch.com). Many organizations may not know they run PHP inside third-party products, CMSs or hosting platforms (olhardigital.com.br).
- Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. The TSE was asked whether its systems are affected (olhardigital.com.br).
- Patch diffing: Experts warn attackers may reverse-engineer the patches. Don Smith (Sophos CTU) expects exploitation to be prioritized within hours or days of release, possibly with AI assistance (olhardigital.com.br).
- Gaps: None of the sources gives CVE identifiers or technical root causes. The latest articles also give no affected versions and no evidence of in-the-wild exploitation.
Remediação
- Update to the current PHP release, 8.5.12. PHP 8.1 and older are unsupported, so those sites must be upgraded (techcrunch.com).
- Apply the updates immediately. If that is not possible, isolate vulnerable systems or take them offline (NSA, CISA via olhardigital.com.br; NSA via techcrunch.com). Brazilian GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline (olhardigital.com.br).
- Where immediate patching is not possible, suspend external access to vulnerable systems, and technically assess all services that use PHP. Keep exposed systems suspended or restricted until patched, as Anatel and the courts did (olhardigital.com.br).
- WordPress site owners must patch their servers and work with their hosting providers (techcrunch.com).
- Inventory all PHP instances, including third-party components, and prioritize internet-facing services. Confirm affected versions against official advisories (olhardigital.com.br).
- Monitor PHP and web server processes for unusual activity or unexpected command execution. Check whether compromise occurred before patching (olhardigital.com.br).
- Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping validate the patches (techcrunch.com).
Relatos divergentes
- Exploitation: The earlier report states no in-the-wild exploitation had been reported (techcrunch.com). A later report says Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report (olhardigital.com.br). The newest articles give no evidence of in-the-wild exploitation (olhardigital.com.br). The attacks are not independently confirmed, so treat exploitation as unverified and likely imminent.
- Impact description: The NSA warning is described as file system or database exposure (techcrunch.com). A later report, citing CERT-EU, describes unauthenticated remote code execution with CVSS 9.2 (olhardigital.com.br). The latter is more specific and more recent.
- Patch scope: One source cites a single release, PHP 8.5.12 (techcrunch.com). The other says four updates were released on 21 October (olhardigital.com.br). These may be compatible, since the updates likely cover several branches, but the sources do not say.
- Discovery and attribution of the flaws: The earlier record describes one flaw reported by Calif with OpenAI and a second reported by Wiz (techcrunch.com, olhardigital.com.br). The newest articles say Calif and OpenAI found the flaws independently in August, and that Wiz later found additional exploitation paths for them (olhardigital.com.br). The newest articles are more recent, but the sources do not reconcile whether Wiz found a separate flaw or further exploitation paths for the same ones.
- Who first identified the flaw in 2024: An earlier article said one flaw was first identified by a researcher in 2024 (olhardigital.com.br). The most recent article, citing the PHP Foundation, attributes the first signs to a 2024 external audit by Quarkslab (olhardigital.com.br). The latter is more recent and is used in the record.
- Impact in Brazil: Earlier reports describe suspensions of SEI and court systems (olhardigital.com.br), while the 23 October article says no major impact had been reported in Brazil so far (olhardigital.com.br). These are likely compatible, as the suspensions were precautionary.
Linha do tempo
-
Critical PHP flaws, first seen in a 2024 audit, trigger preventive takedowns of sites and Brazil's SEI
ler a análise desta fonte ocultar
The PHP Foundation confirmed that the first signs of the PHP vulnerabilities behind preventive site takedowns in several countries date to a 2024 external audit by Quarkslab. The fix stalled and restarted repeatedly because of limited resources and decision-making difficulties in the security team. The flaws could let attackers take control of servers without authentication. A security update is available. Since 21 October, governments and companies have temporarily suspended access to sites, including Anatel and Brazilian courts, which took down the Sistema Eletrônico de Informações (SEI). The article reports no major impact in Brazil so far.
Technical Details
- The vulnerabilities were identified in a 2024 audit by Quarkslab. The delay was attributed to the lack of a known remote command execution method at the time, difficulties in security team decisions, and a shortage of experts who know PHP internals.
- Calif and OpenAI independently found and reported the flaws in August 2026. Wiz later found additional ways to exploit them, using Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol models.
- Wiz called the findings among the most severe ever discovered in PHP and possibly in software history, saying they went unanswered for over a decade because discovery and exploitation were complex without AI.
- The PHP Foundation uses AI tools such as Claude Mythos to analyze code and triage reports, but says they cannot determine the best way to structure a fix.
- PHP is reportedly used by about 70% of sites, including platforms such as WordPress, Moodle and Magento.
- The article gives no CVE identifiers, affected versions or evidence of active exploitation.
Remediation
- Apply the available PHP security update to affected systems; the article presents this as the main measure to reduce the risk of intrusion.
- Preventive suspension of exposed services was used as a temporary measure by public bodies and companies.
-
Two critical unauthenticated PHP flaws force Anatel and Brazilian courts to suspend systems including SEI
ler a análise desta fonte ocultar
Two serious PHP vulnerabilities, reportedly allowing attackers to take control of servers without credentials, led Anatel and Brazilian courts to temporarily suspend access to their systems, including the Sistema Eletrônico de Informações (SEI). The Brazilian federal government issued an alert urging public bodies to update the software. According to the report, the flaws were identified with the help of artificial intelligence, and a fix is already available. The article is a newsletter digest and gives no CVE identifiers, exploitation evidence or technical details.
Technical Details
- Two flaws in PHP that may enable unauthenticated takeover of servers (no login or password required).
- Discovery reportedly assisted by AI.
- No CVEs, affected versions or evidence of in-the-wild exploitation are stated.
Remediation
- Apply the available PHP fix, as urged by the federal government's alert to public bodies.
- Keep exposed systems suspended or restricted until patched, as Anatel and the courts did.
-
Critical unauthenticated PHP flaws force Anatel and Brazilian federal courts to take SEI and other systems offline
ler a análise desta fonte ocultar
Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline. The flaws were found independently by Calif and OpenAI in August, and Wiz later found additional ways to exploit them using AI models. Wiz called them among the most serious PHP vulnerabilities ever found. The NSA recommended patching immediately or shutting down vulnerable systems, and French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency. The article does not give CVE identifiers, affected versions or evidence of in-the-wild exploitation.
Technical Details
- Two vulnerabilities in PHP allow actions on servers without credentials, which can lead to full server takeover.
- Discovered independently by Calif and OpenAI in August 2026. Wiz later found further exploitation paths using the Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI) models.
- PHP is cited as used by roughly 70% of websites and underpins platforms such as WordPress, Moodle and Magento.
- Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. TSE was asked whether its systems are affected.
Remediation
- Update PHP to the fixed release, which is available.
- Where immediate patching is not possible, take vulnerable systems offline or suspend external access.
- Technically assess all services that use PHP.
-
Two critical unauthenticated PHP RCE flaws (CVSS 9.2) patched; early exploitation reported, sites taken offline
ler a análise desta fonte ocultar
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Foundation described the delay in fixing it as a structural process failure. Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report. Experts warn that attackers may reverse-engineer the patches to target unpatched systems.
Technical Details
- CERT-EU confirms the flaws permit remote code execution without authentication or an account.
- Possible impact: data theft, web page defacement, or full system compromise. The NSA warned they could expose server files and databases.
- PHP runs on nearly 70% of sites whose server-side language can be identified, and underpins WordPress (about 40% of websites). Many organizations may not know they are running PHP in third-party products, CMSs or hosting platforms.
- Discovery: Calif, working with OpenAI and using the GPT-5.6 Sol model, reported one flaw on 11 August. Wiz independently found the issues and reported a second flaw on 24 August, also using AI models.
- Don Smith (Sophos CTU) warns that exploitation could be prioritized within hours or days of patch release, including with AI assistance.
Remediation
- Apply the PHP updates immediately; if not possible, isolate or take vulnerable systems offline (NSA, CISA).
- Inventory all PHP instances, including third-party components, and prioritize internet-facing services.
- Confirm affected versions against official advisories.
- Monitor PHP and web server processes for unusual activity or unexpected command execution, and check whether compromise occurred before patching.
-
NSA warns of two critical decades-old PHP flaws found with AI by OpenAI/Calif and Wiz; patched in PHP 8.5.12
ler a análise desta fonte ocultar
The NSA issued a warning on Wednesday about two critical vulnerabilities in PHP, present in all versions since PHP 5 (2004). The PHP Foundation has already released patches. The flaws let attackers reach the server file system or the database used by the web application. The NSA advises that any site that cannot be patched immediately should be taken offline until it can be. No in-the-wild exploitation has been reported so far, but public disclosure starts a race to patch tens of millions of sites.
Technical Details
- One flaw was found by the security firm Calif, working under OpenAI's "Patch the Planet" initiative with GPT-5.6 Sol. Separately, Wiz found multiple PHP vulnerabilities using its Wiz Atlas AI agent, Gemini 4 Argon and GPT-5.6 Sol.
- The flaws were previously considered too hard to exploit. Wiz warns that LLMs can now help adapt exploits to different PHP versions, configurations and memory layouts, which lowers that barrier.
- PHP is reported to power roughly 70% of websites (over 33 million sites) and underpins CMSes such as WordPress. WordPress says the issue is not WordPress-specific.
- The article gives no CVE identifiers or technical root causes.
Remediation
- Update to the current PHP release, 8.5.12. PHP 8.1 and older are unsupported, so those sites need to be upgraded.
- Pull sites offline if they cannot be patched immediately (NSA guidance).
- WordPress site owners must patch their servers and work with their hosting providers.
- Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping validate the patches.