PHP releases fixes for two critical unauthenticated RCE flaws; 'PHP2Shell' bug may affect up to 70% of websites
PHP released security fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 for two critical vulnerabilities allowing unauthenticated remote code execution, affecting all web request-serving installations. The flaws, including a memory-management issue dubbed 'PHP2Shell' discovered via OpenAI's GPT-5.6 Sol in August, may affect up to 70% of websites; OpenAI says these are among several significant vulnerabilities it found and expects similar findings to increase sharply.
Coverage timeline
Techmeme
PHP : PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.
Robert McMillan / Wall Street Journal : PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August — AI tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it.
OpenAI : OpenAI says the PHP flaws, found using GPT-5.6 Sol, “are among several significant vulnerabilities” it found and expects “similar findings to increase sharply” — - Validate and fix the upstream vulnerability. … - Give affected organizations time to act.
Related stories
OpenCode Maker Anomaly Innovations Reports Breach of ~1.4% of Console Users' API Keys
Anomaly Innovations, maker of the open-source coding agent OpenCode, disclosed a breach affecting roughly 1.4% of OpenCode Console users and their API keys, describing it as a large-scale distillation attack. Hackers accessed part of the online platform, stole API keys, and ran up charges on users' AI accounts; the AI tools OpenCode relied on reportedly refused to analyze the malicious code.
2 reports · 2 sources
OpenAI Codex lead Tibo pledges 28-day daily improvement or quota reset; first day boosts GPT-6 inference speed ~50%
OpenAI Codex lead Tibo announced a 28-day commitment to deliver either a meaningful improvement for Codex/Work users or a full quota reset each day, following user complaints about slow models and reduced quotas after DevDay. On the first day, OpenAI boosted default inference speed for GPT-6 Astra and GPT-6.1 Sol by ~50% to 50 TPS across subscriptions and partner products, while also introducing text watermarking. The move comes amid a user trust crisis and a SemiAnalysis report claiming Anthropic subscriptions offer 5x more value than OpenAI's.
4 reports · 2 sources
OpenAI launches GPT-6.1 Sol Ultrafast, 8x faster than standard
OpenAI released GPT-6.1 Sol Ultrafast, a faster version of its frontier model, claiming near-Astra intelligence at up to 8x the speed of the standard Sol. API pricing is $12 per million input tokens and $60 per million output tokens, six times the standard rate. The model is available to all users following the previous day's rollout of GPT-6 to free and paid tiers.
2 reports · 2 sources
Anthropic: Claude flags 493 security issues in 25 open-source projects
Anthropic previewed data from using Claude to reduce the attack surface of large open-source codebases. The analysis flagged 493 security issues across 25 projects covering over 5 million lines of C, C++, Java, PHP, and Python code, including one vulnerability that had gone unnoticed for 21 years.
2 reports · 2 sources112 points · 74 comments
News updates every hour. Subscribe in your RSS reader to get new stories automatically.
Subscribe