Two serious flaws in PHP could allow access to a web server’s files or a database used by its application.
The issues were present in PHP versions going back to PHP 5, released in 2004.
The PHP Foundation has issued fixes; the U.S.
NSA says sites that cannot be patched immediately should be taken offline until they can be updated.
These problems have been hidden in all versions of PHP since version 5, which was released in 2004. PHP developers have already released fixes with a new security release. Administrators are advised to upgrade their systems to the current version 8.5.12, as older versions, such as 8.1 and earlier, are no longer officially supported. Attacks that exploit these vulnerabilities could give attackers access to the file system or databases used by applications.
How were the gaps identified?
The problems were uncovered with the help of artificial intelligence systems. The security company Calif used the GPT-5.6 Sol model, as part of an OpenAI initiative, and identified one of the weaknesses. Meanwhile, the Wiz team used the Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol tools to find multiple gaps, working with companies including Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, and Vercel.
The next day and the dangers
According to OpenAI, the vulnerabilities were identified by researchers before hackers discovered them, and there are currently no reports of attacks in progress. However, Wiz warned that AI tools can help adapt attack methods to different PHP versions, configurations, and memory architectures.
READ ALSO
Urgent security updates for PHP due to serious vulnerabilities
WordPress clarified in a statement that the problem is not exclusive to its own platform and that those using its system should update their servers and work with their hosting companies.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)