The NSA issued an alert on two severe vulnerabilities in PHP, the server-side language that underpins roughly 70% of websites, including those running WordPress. The flaws, present since PHP version 5 in 2004, let attackers access a server's file system or database, and the PHP Foundation has already released patches, recommending an update to PHP 8.5.12. The bugs were uncovered through AI-driven security research: one by Calif using OpenAI's GPT-5.6 Sol under its 'Patch the Planet' program, and others by Google-owned Wiz using its Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol.
techcrunch.com
· 2026-10-21
Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
theverge.com
· 2026-10-21
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
wiz.io
· 2026-10-21
Momentum Cyber projects cybersecurity acquisitions will rise to roughly 450 deals in 2026, up from 404 last year, even as the number of funding rounds slips to an annualized 754 from 820. The firm points to identity management, non-human identity, data security, agentic security, runtime protection and operational-technology security as the hottest categories, citing recent deals like Cyera's $1 billion acquisition of Oasis Security and Cisco's purchases of Astrix Security and WideField Security.
darkreading.com
· 2026-10-09
On TechCrunch's Equity podcast, Index Ventures partner Shardul Shah discussed how surging concern over AI safety and rogue agents is driving cybersecurity stocks up and pulling large capital into startups building security for AI-native systems, citing nine-figure funding rounds for companies like Instinct and Simile. Shah, who backed cloud security firm Wiz through six funding rounds before its $32 billion acquisition by Google, said periodic, human-in-the-loop security models are struggling to keep pace with AI-driven threats.
techcrunch.com
· 2026-09-23
Wiz researchers found multiple threat actors exploiting two Artifactory vulnerabilities, CVE-2026-42018 and CVE-2026-42016, to escalate from a low-privileged anonymous session to full administrator access in under five minutes in some cases. Once inside, attackers installed malicious Groovy plugins to run commands and deployed a custom Rust-based backdoor with command-and-control capabilities, alongside webshells and stolen configuration data. A separate critical flaw, CVE-2026-82329, has also been used by other attackers to mint admin tokens on unpatched instances.
bleepingcomputer.com
· 2026-09-11
GoKawiil