Two critical security flaws have been discovered in all implementations of the PHP programming language, affecting millions of websites globally. The vulnerabilities impact PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed installations. The highest risk is associated with mod_php, where the exploit can trigger unauthenticated requests before application code runs.
Fixed versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The discovery was aided by OpenAI's GPT-5.6 Sol LLM as part of the "Patch the Planet" initiative, which uses formal verification to identify vulnerabilities. Tech Power Up's infrastructure also relies on PHP and is currently migrating to the latest version.
This marks the beginning of a series of AI-driven security challenges for infrastructure maintainers.
Source: TechPowerUp News · Summarized by HeadlinesBriefing