PSA: Critical Security Flaw in PHP Exposes Millions of Website, Update Fast

For fellow infrastructure maintainers, today marks just the beginning of what could be a series of AI-driven security challenges. Two critical security flaws have been discovered in all variations and implementations of the PHP programming language used for the web. With millions of websites relying on PHP, this security flaw affects all installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The highest risk is currently associated with mod_php, as the exploit can trigger an unauthenticated request before any application code runs. PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 include fixes for these vulnerabilities, and users are strongly encouraged to update their PHP versions across their entire infrastructure. The discovery of this vulnerability was aided by OpenAI's GPT-5.6 Sol LLM, which is part of the "Patch the Planet" initiative. This initiative helps software maintainers worldwide discover, patch, and test software for vulnerabilities. It supports many software maintainers by running extensive formal verification and checks with agents to ensure software behaves as intended and that there are no side channels to bypass modern software security. As a result, we can expect more of these discoveries in the future.