Immediate Software Updates Recommended for Consumers After Identification of PHP Security Issues
Researchers said AI helped turn decade-old PHP flaws into working exploits, prompting emergency patches as hackers made millions of attempts within hours.
- Researchers at VulnCheck developed a new exploit that bypasses Address Space Layout Randomization on x86-64 servers, enabling Remote Code Execution on PHP and marking a "significant advance" against real-world systems.
- Historically, ASLR served as a critical defense by scrambling memory locations to prevent malicious code execution. Spencer McIntyre, director of exploit development at VulnCheck, warned that relying on such protections is insufficient against modern AI-driven bug hunting.
- Following the PHP Foundation disclosure on Wednesday, OndYej Sur worked to distribute critical patches for Debian and Ubuntu. Sur stated, "I don't have that much time to prepare the packaging" due to the incident's severity.
- More than $10,000 in donations highlighted reliance on volunteer maintainers, prompting Sur to urge major organizations to support open-source software. "I think they should be more responsible," he said, "or it will backfire."
- AI capabilities are accelerating vulnerability discovery, Sur warned, potentially leading to more frequent security incidents in the near future. Organizations must be prepared to act rapidly as these threats evolve, he said.
138 Articles
138 Articles
9NEWS Denver
Immediate software updates recommended for consumers after identification of PHP security issues
While PHP vulnerability patches are up to developers, experts say software updates by consumers can at least help ensure that your system's security is current.
At the age of 13, Ryan Austin dropped out of high school due to family issues. Years later, his curiosity about computers turned him into one of the researchers who helped discover a serious vulnerability at the heart of much of the internet. The 37-year-old American works remotely for a cybersecurity company in Calif. In August 2026, he discovered a problem in the core of the PHP programming language, used by about 70% of websites, according to…
The PHP developer who became the unsung hero of the internet
Global Cybersecurity Alert: Critical PHP vulnerabilities raise fears of website disruptions and data exposure
A series of critical vulnerabilities in PHP, one of the internet’s widely used programming languages, has triggered a global cybersecurity alert, raising concerns about the security of government portals, business websites and other online services. The reported flaws could allow attackers to execute malicious code remotely on vulnerable servers, potentially compromising systems, exposing sensitive information and disrupting digital services. Th…
Coverage Details
Bias Distribution
- 38% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
