PHP Patches Two Critical Remote Code Execution Flaws Found With AI Assistance

PHP issued security updates on Wednesday addressing two critical vulnerabilities that permit unauthenticated remote code execution. Researchers located both flaws with assistance from AI models. The PHP security team had set the release for 14:00 UTC, which corresponds to 10 a.m. ET. Each vulnerability received a severity rating of 9.2 on the CVSS v4.0 scale. The flaws allow attackers to execute code remotely without authentication, a class of vulnerability considered among the most dangerous for server-side software. AI models contributed to the discovery process, a detail that places the release within a growing pattern of machine-assisted security research. The patches were made available through official PHP security updates. No further technical details about the individual vulnerabilities were provided in the source material.