Two critical PHP vulnerabilities force emergency patching; Wiz CTO warns AI will accelerate bug discovery
Two critical vulnerabilities in PHP, the language behind roughly 70% of websites, sent organizations scrambling to patch last week. Some took sites offline until fixes were applied. Wiz CTO of Exposure Management & AppSec Tomer Schwartz took part in the response alongside OpenAI, the research group Calif and the PHP team. He says Wiz could not have found the bugs without AI, using custom tooling to test dozens of ideas over a weekend. He also says one bug sat unnoticed for more than a decade, and that AI is speeding up both the discovery and exploitation of novel vulnerabilities. The article is a podcast promotion and gives no CVE IDs, affected versions, IOCs or exploitation details.
Entenda a falha
A vulnerabilidade
Two critical vulnerabilities in PHP, the open source language behind roughly 70% of websites, were disclosed and patched last week. The articles give no CVE IDs, flaw types, affected component, attacker prerequisites, impact or affected and fixed versions. Some organizations took sites offline until they could patch, and some systems are reported to remain unpatched.
Como funciona
The articles do not describe how the vulnerable code path works, what input reaches it or at which step it fails. Nothing can be said about the mechanism of either bug beyond the fact that they were critical and, according to the researchers, exploitable.
Por que é vulnerável
The root causes are not given. The only related detail is that one bug sat in plain sight for more than a decade, and Wiz's CTO says something changed that made it exploitable, though the articles do not say what. The fix is described only as PHP security patches, with no detail on what they change.
Como foi descoberta
According to the podcast description, Wiz's Tomer Schwartz took part in the response alongside OpenAI, the research group Calif and the PHP team. He says Wiz could not have found the bugs without AI, using custom tooling that tested dozens of ideas over a weekend, and that one bug went unnoticed for more than a decade. He also says leaks are almost inherent to coordinated disclosure and that Wiz planned for this. The articles do not say who reported what or when.
Explicação gerada por IA a partir da matéria e dos artigos, em 01/11/2026 16:16.
Detalhes técnicos
- Two critical PHP bugs were disclosed and patched; the article does not name the flaw types or the CVEs.
- One bug reportedly remained undetected for more than a decade before AI-assisted research made it discoverable and exploitable.
- Schwartz says leaks are almost inherent to coordinated disclosure, and that Wiz planned for this.
- Some systems remain unpatched. The episode addresses whether WordPress site owners are at risk, but the article gives no answer.
Remediação
- Apply the latest PHP security patches. Specific fixed versions are not given in the article.
- Schwartz argues that manual patching will not scale, which points to automated patch and exposure management.
Linha do tempo
-
Two critical PHP vulnerabilities force emergency patching; Wiz CTO warns AI will accelerate bug discovery
ler a análise desta fonte ocultar
Two critical vulnerabilities in PHP, the language behind roughly 70% of websites, sent organizations scrambling to patch last week. Some took sites offline until fixes were applied. Wiz CTO of Exposure Management & AppSec Tomer Schwartz took part in the response alongside OpenAI, the research group Calif and the PHP team. He says Wiz could not have found the bugs without AI, using custom tooling to test dozens of ideas over a weekend. He also says one bug sat unnoticed for more than a decade, and that AI is speeding up both the discovery and exploitation of novel vulnerabilities. The article is a podcast promotion and gives no CVE IDs, affected versions, IOCs or exploitation details.
Technical Details
- Two critical PHP bugs were disclosed and patched; the article does not name the flaw types or the CVEs.
- One bug reportedly remained undetected for more than a decade before AI-assisted research made it discoverable and exploitable.
- Schwartz says leaks are almost inherent to coordinated disclosure, and that Wiz planned for this.
- Some systems remain unpatched. The episode addresses whether WordPress site owners are at risk, but the article gives no answer.
Remediation
- Apply the latest PHP security patches. Specific fixed versions are not given in the article.
- Schwartz argues that manual patching will not scale, which points to automated patch and exposure management.