AI finds two critical PHP vulnerabilities: emergency updates and regulator warnings
Researchers from Calif and Wiz, using AI, discovered two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, rated 9.2/10) in the PHP language, affecting versions from 5.4 to 8.5.11. Developers released emergency patches on October 21, and regulators in the US, UK, EU and Australia urged urgent system updates. Cloudflare recorded attacks after details leaked ahead of the official disclosure.
Madina Usmonova