📅 Oct 22, 2026
Two critical bugs in PHP were sitting there for over a decade. AI researchers found them before attackers could cash in.
LexxWire
CVE-2026-109618 and CVE-2026-109619 score 9.2 out of 10. One lets attackers run code on servers without logging in.
LexxWire
Wiz used Gemini 4 Argon and GPT-5.6 Sol; Calif used GPT-5.6 Sol too. A researcher did in about a week what takes teams months.
LexxWire
PHP powers sites like WordPress, Drupal and Joomla. Censys found about 1.5 million of 2.6 million scanned hosts still unpatched.
LexxWire
Patches for PHP 8.5, 8.4, 8.3 and 8.2 are out. The NSA says to update immediately or take servers offline.
LexxWire
Thanks for reading!