AI News Feed
Market watch
Sony sets Nov. 19 launch for $100 PlayStation Pulse headsetSupernatural returns to Meta headsets as independent early-access appIntel Marks Ohio Fab Construction Milestone as Project Runs at Least Five Years LateRed Hat and Nvidia expand partnership to secure autonomous AI agentsWindscribe Changelog Credits Anthropic's Fable 5 With AI Security AuditHuman Data Hint at Psilocybin's Potential Against Inflammation
Sony sets Nov. 19 launch for $100 PlayStation Pulse headsetSupernatural returns to Meta headsets as independent early-access appIntel Marks Ohio Fab Construction Milestone as Project Runs at Least Five Years LateRed Hat and Nvidia expand partnership to secure autonomous AI agentsWindscribe Changelog Credits Anthropic's Fable 5 With AI Security AuditHuman Data Hint at Psilocybin's Potential Against Inflammation
Cybersecurity

PHP Plans Emergency Patches for Two 9.2-Severity Vulnerabilities

PHP to issue emergency patches for two 9.2-severity flaws in 12 hours; users told to prepare after exploit leak.

AI News Feed · 2026-10-22 01:34

“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” the advisory stated. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.”

The maintainers published the advisory after purported details of the vulnerabilities leaked, although the report has not been confirmed. According to the report, a video showed an exploit tool dubbed PHP2Shell executing code on webservers running WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Laravel 8.83.29, Symphony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9, all of which use PHP.

Attempts to locate the unconfirmed report were unsuccessful, Slashdot reported. Security firm watchTowr said the report claimed to affect every PHP version from PHP 5, released in 2004, onward. watchTowr also said it had confirmed that the vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are real.

Researchers from security firm Sansec said they “expect mass attacks to start within 15 minutes of the release.” A third security firm, Webfence, also urged administrators to prepare now, and Huntress issued an advisory, according to the report.