The NSA issued an alert on two severe vulnerabilities in PHP, the server-side language that underpins roughly 70% of websites, including those running WordPress. The flaws, present since PHP version 5 in 2004, let attackers access a server's file system or database, and the PHP Foundation has already released patches, recommending an update to PHP 8.5.12. The bugs were uncovered through AI-driven security research: one by Calif using OpenAI's GPT-5.6 Sol under its 'Patch the Planet' program, and others by Google-owned Wiz using its Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol.
techcrunch.com
· 2026-10-21
Trail of Bits has released two agent-based plugins, patching-bugs and regression-hunt, built through its Patch the Planet collaboration with OpenAI. The patching-bugs plugin reproduces reported bugs and develops and tests fixes, while regression-hunt checks whether changes break previously working, supported behavior. The company says a review of over 130 merged Patch the Planet PRs found 21 regressions, none of which broke a security protection.
blog.trailofbits.com
· 2026-10-21
A tester given preview access to GPT-5.6-Cyber challenged the AI agent to escape a QEMU/KVM virtual machine on a Debian Linux host. The model succeeded three separate times, first using recently disclosed kernel bugs, then unpatched vulnerabilities not yet flagged as security issues, and finally by discovering its own zero-day exploits after the system was rebuilt from the latest source code.
blog.trailofbits.com
· 2026-08-26
GoKawiil