Frontier models found the flaw under most of the web [Oct 22 2026]
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC on 21 October, fixing two unauthenticated remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4 9.2 and reaching back to PHP 5.4. Wiz Research, which says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, reports the underlying bugs sat in the engine for over a decade because demonstrating exploitability was "at the edge of what human researchers could practically achieve." The PHP Foundation says a core developer found the first signs of the same root cause in 2024 and that the stalled fix "was a…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.