Critical unauthenticated PHP flaws (CVSS 9.2) found with AI and patched; NSA urges patching; Brazil, France take sites offline
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 23/10/2026 00:10; os links antigos trazem para cá.
Two critical vulnerabilities affect PHP, in all versions since PHP 5 (2004). The NSA warned about them on Wednesday 21 October 2026, saying they let attackers reach the server file system or the database used by the web application (techcrunch.com). The PHP Foundation released four updates on 21 October 2026, including PHP 8.5.12. Each flaw is rated CVSS 9.2 and allows unauthenticated remote code execution, according to CERT-EU (olhardigital.com.br). One was reported by Calif with OpenAI and the other by Wiz, both using AI models. Exploitation status is disputed: the earlier report said none had been observed (techcrunch.com), while a later report cites first attacks from Cloudflare's CTO, which CISA had not confirmed (olhardigital.com.br). Governments and companies reportedly took sites offline as a precaution (olhardigital.com.br). On 22 October 2026 the impact became concrete in Brazil: Anatel and the federal courts TRF1, TRF4 and TRF6 suspended external access to systems including the Sistema Eletrônico de Informações (SEI), after an alert from the Brazilian CISC on 21 October. GSI told federal IT managers to update immediately and MGI told federal teams to temporarily take PHP-based systems offline. French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency (olhardigital.com.br).
Entenda a falha
A vulnerabilidade
Two critical PHP flaws, with no CVE IDs in the coverage. CERT-EU, quoted by Olhar Digital, rates each CVSS 9.2 and describes unauthenticated remote code execution, with no account or password. The NSA, as reported by TechCrunch, describes access to the server file system or the web app's database. The affected component is not named. The flaws sit in all versions since PHP 5 (2004). PHP 8.1 and older are unsupported and must be upgraded. The PHP Foundation released four updates on 21 October 2026, including 8.5.12, the current release.
Como funciona
The articles do not describe how the vulnerable code path works. They say only that a remote attacker with no credentials can reach a server running a vulnerable PHP and, through it, run commands and reach files or the database, up to full takeover. Which input reaches which PHP component, and at which step it goes wrong, is not disclosed.
Por que é vulnerável
The articles give no root cause and do not say what the patches change. They say one flaw was first identified by a researcher in 2024, and the PHP Foundation called the delay in fixing it a structural process failure. Wiz says the flaws went unaddressed for over a decade because finding and exploiting them was very complex without AI. TechCrunch adds that they were previously considered too hard to exploit.
Como foi descoberta
Calif, working with OpenAI under its Patch the Planet initiative and using GPT-5.6 Sol, reported one flaw to PHP on 11 August. Wiz, using its Wiz Atlas agent, Gemini 4 Argon and GPT-5.6 Sol, reported a second on 24 August. Both followed coordinated disclosure and tested the patches with Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel. A later article says Calif and OpenAI found the flaws independently and Wiz found further ways to exploit them. The sources do not reconcile this. Exploitation is disputed: TechCrunch, citing OpenAI, says none was seen; Olhar Digital says Cloudflare's CTO reported first attacks, which CISA had not confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 00:26.
Detalhes técnicos
- Impact: CERT-EU confirms remote code execution without authentication or an account. Possible outcomes are data theft, web page defacement or full system compromise (olhardigital.com.br). The later report adds that the flaws allow actions on servers without credentials, which can lead to full server takeover (olhardigital.com.br).
- Discovery by Calif: The firm found one flaw under OpenAI's "Patch the Planet" initiative with GPT-5.6 Sol (techcrunch.com). It reported the flaw on 11 August (olhardigital.com.br). A later article says Calif and OpenAI discovered the flaws independently in August 2026 (olhardigital.com.br).
- Discovery by Wiz: The firm found multiple PHP vulnerabilities with its Wiz Atlas AI agent, Gemini 4 Argon and GPT-5.6 Sol (techcrunch.com). It reported a second flaw on 24 August (olhardigital.com.br). The later article says Wiz found further ways to exploit the flaws using Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI), and that Wiz called them among the most serious PHP vulnerabilities ever found (olhardigital.com.br).
- Earlier identification: One flaw was first identified by a researcher in 2024. The Foundation called the delay in fixing it a structural process failure (olhardigital.com.br).
- Exploitability: The flaws were previously considered too hard to exploit. Wiz warns that LLMs can now help adapt exploits to different PHP versions, configurations and memory layouts (techcrunch.com).
- Reach: PHP powers roughly 70% of websites (over 33 million sites) and underpins CMSes such as WordPress (techcrunch.com), and platforms such as Moodle and Magento (olhardigital.com.br). WordPress says the issue is not WordPress-specific (techcrunch.com). Many organizations may not know they run PHP inside third-party products, CMSs or hosting platforms (olhardigital.com.br).
- Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. The TSE was asked whether its systems are affected (olhardigital.com.br).
- Patch diffing: Experts warn attackers may reverse-engineer the patches. Don Smith (Sophos CTU) expects exploitation to be prioritized within hours or days of release, possibly with AI assistance (olhardigital.com.br).
- Gaps: None of the sources gives CVE identifiers or technical root causes. The latest article also gives no affected versions and no evidence of in-the-wild exploitation.
Remediação
- Update to the current PHP release, 8.5.12. PHP 8.1 and older are unsupported, so those sites must be upgraded (techcrunch.com).
- Apply the updates immediately. If that is not possible, isolate vulnerable systems or take them offline (NSA, CISA via olhardigital.com.br; NSA via techcrunch.com). Brazilian GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline (olhardigital.com.br).
- Where immediate patching is not possible, suspend external access to vulnerable systems, and technically assess all services that use PHP (olhardigital.com.br).
- WordPress site owners must patch their servers and work with their hosting providers (techcrunch.com).
- Inventory all PHP instances, including third-party components, and prioritize internet-facing services. Confirm affected versions against official advisories (olhardigital.com.br).
- Monitor PHP and web server processes for unusual activity or unexpected command execution. Check whether compromise occurred before patching (olhardigital.com.br).
- Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping validate the patches (techcrunch.com).
Relatos divergentes
- Exploitation: The earlier report states no in-the-wild exploitation had been reported (techcrunch.com). The later report says Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report (olhardigital.com.br). The newest article gives no evidence of in-the-wild exploitation (olhardigital.com.br). The attacks are not independently confirmed, so treat exploitation as unverified and likely imminent.
- Impact description: The NSA warning is described as file system or database exposure (techcrunch.com). The later report, citing CERT-EU, describes unauthenticated remote code execution with CVSS 9.2 (olhardigital.com.br). The latter is more specific and more recent.
- Patch scope: One source cites a single release, PHP 8.5.12 (techcrunch.com). The other says four updates were released on 21 October (olhardigital.com.br). These may be compatible, since the updates likely cover several branches, but the sources do not say.
- Discovery and attribution of the flaws: The earlier record describes one flaw reported by Calif with OpenAI and a second reported by Wiz (techcrunch.com, olhardigital.com.br). The newest article says Calif and OpenAI found the flaws independently in August, and that Wiz later found additional exploitation paths for them (olhardigital.com.br). The newest article is more recent, but the sources do not reconcile whether Wiz found a separate flaw or further exploitation paths for the same ones.
Linha do tempo
-
Critical unauthenticated PHP flaws force Anatel and Brazilian federal courts to take SEI and other systems offline
ler a análise desta fonte ocultar
Two critical PHP vulnerabilities, reportedly allowing unauthenticated attackers to take control of servers, led Anatel and several Brazilian federal courts (TRF1, TRF4, TRF6) to suspend external access to systems including the Sistema Eletrônico de Informações (SEI). The Brazilian CISC issued an alert on 21 October 2026. GSI instructed federal IT managers to update immediately, and MGI told federal teams to temporarily take PHP-based systems offline. The flaws were found independently by Calif and OpenAI in August, and Wiz later found additional ways to exploit them using AI models. Wiz called them among the most serious PHP vulnerabilities ever found. The NSA recommended patching immediately or shutting down vulnerable systems, and French local government sites, including that of the Paris Police Prefecture, were made inaccessible at the request of the national cybersecurity agency. The article does not give CVE identifiers, affected versions or evidence of in-the-wild exploitation.
Technical Details
- Two vulnerabilities in PHP allow actions on servers without credentials, which can lead to full server takeover.
- Discovered independently by Calif and OpenAI in August 2026. Wiz later found further exploitation paths using the Gemini 4 Argon (Google) and GPT-5.6 Sol (OpenAI) models.
- PHP is cited as used by roughly 70% of websites and underpins platforms such as WordPress, Moodle and Magento.
- Impact in Brazil: Anatel suspended external access to SEI and other internet-facing services. TRF1, TRF4 and TRF6 took similar measures, and TRF6 also suspended its electronic judicial process system. TSE was asked whether its systems are affected.
Remediation
- Update PHP to the fixed release, which is available.
- Where immediate patching is not possible, take vulnerable systems offline or suspend external access.
- Technically assess all services that use PHP.
-
Two critical unauthenticated PHP RCE flaws (CVSS 9.2) patched; early exploitation reported, sites taken offline
ler a análise desta fonte ocultar
Two critical vulnerabilities in the PHP language, each rated CVSS 9.2, allow unauthenticated remote code execution on vulnerable servers. Governments and companies reportedly took sites offline as a precaution. The PHP Foundation released four updates on 21 October 2026. One flaw was first identified by a researcher in 2024, and the Foundation described the delay in fixing it as a structural process failure. Cloudflare's CTO reported the first attacks, while CISA said it had not observed exploitation at the time of the Reuters report. Experts warn that attackers may reverse-engineer the patches to target unpatched systems.
Technical Details
- CERT-EU confirms the flaws permit remote code execution without authentication or an account.
- Possible impact: data theft, web page defacement, or full system compromise. The NSA warned they could expose server files and databases.
- PHP runs on nearly 70% of sites whose server-side language can be identified, and underpins WordPress (about 40% of websites). Many organizations may not know they are running PHP in third-party products, CMSs or hosting platforms.
- Discovery: Calif, working with OpenAI and using the GPT-5.6 Sol model, reported one flaw on 11 August. Wiz independently found the issues and reported a second flaw on 24 August, also using AI models.
- Don Smith (Sophos CTU) warns that exploitation could be prioritized within hours or days of patch release, including with AI assistance.
Remediation
- Apply the PHP updates immediately; if not possible, isolate or take vulnerable systems offline (NSA, CISA).
- Inventory all PHP instances, including third-party components, and prioritize internet-facing services.
- Confirm affected versions against official advisories.
- Monitor PHP and web server processes for unusual activity or unexpected command execution, and check whether compromise occurred before patching.
-
NSA warns of two critical decades-old PHP flaws found with AI by OpenAI/Calif and Wiz; patched in PHP 8.5.12
ler a análise desta fonte ocultar
The NSA issued a warning on Wednesday about two critical vulnerabilities in PHP, present in all versions since PHP 5 (2004). The PHP Foundation has already released patches. The flaws let attackers reach the server file system or the database used by the web application. The NSA advises that any site that cannot be patched immediately should be taken offline until it can be. No in-the-wild exploitation has been reported so far, but public disclosure starts a race to patch tens of millions of sites.
Technical Details
- One flaw was found by the security firm Calif, working under OpenAI's "Patch the Planet" initiative with GPT-5.6 Sol. Separately, Wiz found multiple PHP vulnerabilities using its Wiz Atlas AI agent, Gemini 4 Argon and GPT-5.6 Sol.
- The flaws were previously considered too hard to exploit. Wiz warns that LLMs can now help adapt exploits to different PHP versions, configurations and memory layouts, which lowers that barrier.
- PHP is reported to power roughly 70% of websites (over 33 million sites) and underpins CMSes such as WordPress. WordPress says the issue is not WordPress-specific.
- The article gives no CVE identifiers or technical root causes.
Remediation
- Update to the current PHP release, 8.5.12. PHP 8.1 and older are unsupported, so those sites need to be upgraded.
- Pull sites offline if they cannot be patched immediately (NSA guidance).
- WordPress site owners must patch their servers and work with their hosting providers.
- Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for helping validate the patches.