- /
- Creators/
- Simon Willison — Creator of Datasette; co-creator of Django/
- Today's PHP Security Release, and How We're Strengthening PHP Security/
Today's PHP Security Release, and How We're Strengthening PHP Security
Blog · Watch/Read
- PHP has released urgent security updates across its 8.x line to address two critical remote code execution (RCE) vulnerabilities, emphasizing the vital need to upgrade immediately due to exploits circulating early.
- The urgency was heightened by a leak in the coordinated disclosure process, where CVE IDs circulated prematurely, followed by a security firm (Calif) mistakenly publishing a proof-of-concept video, accelerating exploit development.
- The vulnerabilities were originally discovered by Wiz Research in August 2026 using AI tools like “Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol,” confirming RCE against platforms such as Drupal and WordPress.
- It is vital for anyone running PHP to upgrade their systems immediately to patch these RCE holes, as active exploits are already in circulation.