Wiz says AI helped it find critical PHP flaws; patched PHP is out, update now

Wiz Research has disclosed serious memory-safety flaws in PHP itself, grouped under two CVEs with severity up to CVSS 9.2. Wiz says every PHP version released in the last decade, back to 5.4, is hit by at least one of them, and that an attacker can run code on a server or read its memory (passwords, tokens, API keys) without logging in. Because the bug is in PHP, not the app, a site can be at risk even if its own code is fine; Wiz showed pre-login attacks on WordPress, Drupal and Joomla. PHP released patched versions on 21 October, the same day as disclosure. Wiz used its Wiz Atlas tool with Gemini 4 Argon and GPT-5.6 Sol, and says AI made it practical to chain the old bugs into working exploits. On Hacker News (432 points, 172 comments, 25 top-level comments from 24 people when we checked), several commenters tried to work out who found what first, pointing to a separate write-up by Calif, and one asked why it took about two months from report to patch. Another camp called it one of the worst flaws ever, with one commenter calling it worse than Log4Shell. A sceptical camp said the write-up reads like marketing, and one noted that no compute costs were given. Others asked practical questions, such as whether SELinux limits the damage and where to find code to check a fix. No consensus on credit or framing. Sorted take: whatever the credit fight, the job is simple: find every PHP server you run, including old ones, and patch it. Expect more old bugs like this as AI makes them cheaper to exploit.