Comment by tetraodonpuffer
9 hours ago
surprising it took nearly a month to acknowledge the bug
August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
Took them almost 7 years even. According to the Calif write-up it was already reported in 2019 (https://bugs.php.net/bug.php?id=78876) and 2024 (https://ostif.org/php-audit-complete/).
Lol wait so OpenAI's LLM to discover this vulnerability most likely just looked it up in an old forum post?
This isn't a terribly uncommon method of 'discovery'. In maths and sciences there have been tons of papers that have highlighted something new but were never really connected to anything else and then largely forgotten. Later they are picked up by someone else and connected to a much bigger whole.
It's only one piece in the full exploit chain.
That's what my agent did to find a UAF. It just took a public one from calif off the internet and found it still flagged asan.
[flagged]
That's how 90+% of script kiddy -type hackings happen, isn't it. That or publically available databases without a password.
AI is gonna make our stuff pretty robust, eventually. The transition phase might hurt a bit.
The bug you posted was patched and fixed 6 years ago, and none of the other bugs in the audit showcase that issue. Are you sure these are the right links?
No way to prevent this, says only language where this regularly happens
Criticals happen in other languages all the time. You are seeing this with PHP in the news because it's used on 70% of the Internet.
1 reply →
LOL
PHP will always be the slop before AI.