GPT-5.6 Sol and Gemini 4 Argon help find critical PHP exploit
Researchers using GPT-5.6 Sol plus Gemini 4 Argon and human review found a PHP flaw letting unauthenticated attackers run code or read secrets.
AI systems found a working server takeover exploit in PHP, one of the most critical cybersecurity issues in recent memory! - The vulnerability was found using a mix of OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, plus human expertise - PHP is the programming language behind ~70% of websites, most notably Wordpress - The bugs sit in PHP itself, so nearly every PHP site is exposed no matter how well its own code is written. Merely running PHP itself is the risk - The vulnerability lets an attacker with no login either run code on a server or read its memory, which can hold passwords, session tokens, API keys, or other secrets - The flaw is from from how PHP cleans up when a request crashes after running out of memory: corrupted state is left behind and the next request can pick it up. An attacker can force that memory crash with a crafted upload, so even a bare page on a vulnerable version can be taken over.
This post quotes another post: x.com/wsj/status/2112904928251240943