Researchers used AI to find two critical PHP flaws - AWS says exploitation attempts began four days before the patch
On October 21, the PHP developers released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two vulnerabilities rated 9.2 on the CVSS scale - both let attackers take over a server without logging in. They were found by researchers from OpenAI, Wiz and Calif using the GPT-5.6 Sol and Gemini 4 Argon models. According to AWS, attackers tried to exploit the flaws as early as October 17, and on the day the patches came out some European governments temporarily took their websites offline as a precaution, CNN, Laravel News and Wired report.