Skip to content
Sign in
Technology · Global

Wiz Research findings lead PHP to patch two security flaws

PHP patched two security flaws identified by Wiz Research, addressing vulnerabilities in a language widely used to power websites and server-side applications.

AI-assisted synthesis · Based on 5 outlets' reporting · Article text read from 1 of 5 outlets · 1 article captured only in partHow it's made

View timeline · 12 entries
5 outlets2 regionsLatest reporting 4 min read
Coverage: Center OnlyL 0 · C 4 · R 0 · 1 unrated

What happened

Key facts

  • Wiz Research identified two security flaws in PHP.
  • PHP patched both flaws identified by Wiz Research.
  • PHP’s interpreter executes application code on a server.
  • PHP application code can process user input, access files, or communicate with databases.
  • The reported flaws were in PHP itself, not in a single website or service.
  • The consequences of a flaw depend on how an application uses the affected component.

The brief

PHP patched two flaws after Wiz Research found them, according to Forkast.news. The outlet says researchers discovered the flaws on Aug 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, then reported them on Aug 24. PHP applied the patch on Oct 21. The account does not describe the flaws’ technical characteristics.

Forkast.news places the PHP findings within a cluster of security disclosures that it says landed between Oct 19 and Oct 22, 2026. The community label “Black October” is circulating for that cluster.

AOL’s headline describes AI agent swarms as hacking “Half The Internet” in a “Black October” phenomenon, while Axios’s headline calls bugs discovered by OpenAI technology a cyber emergency. Those headlines frame the broader activity, but do not add details about the PHP flaws or patch. The reported origin of the label is uncertain.

Forkast.news says it was reportedly coined in an X post early on Oct 22, which called the previous 48 hours “the worst in cybersecurity history.” The outlet says two searches of X covering Oct 21 to 23 found no matching post. It therefore describes the post as the reported source of the label rather than confirming its existence.

The article also describes a separate eMudhra key issue. It says the keys had been weak since April 2025, with a wrong-key warning in June, and links them to an April 30, 2025 ceremony batch of 24. eMudhra attributed the problem to a flawed ceremony script that created a second, weaker key pair; the outlet says the similar labels led to the wrong pair being used.

Researcher “Wayne” reported the compromise on Oct 17 at 18:05 UTC. Forkast.news further says figures associated with researcher “kaba”’s directory analysis were reported by The Hacker News and SC World. It places the public writeups between Oct 5 and 21, with the largest on Oct 21, and says the interception had run and finished before the “Black October” label existed.

The article’s timeline thus places several distinct cybersecurity disclosures alongside the PHP patch, without stating that the PHP flaws caused or were technically linked to the other incidents. For the PHP story, the reported sequence is discovery, reporting and patching: Aug 19, Aug 24 and Oct 21.

The outlet does not say what the patch changed or whether users needed to take further action. Its account reports the patch as the concrete outcome of the Wiz Research findings.

Why it matters

  • PHP underpins many websites and server-side applications, so flaws in the language can expose systems that rely on it to attack or disruption. The fixes give PHP users and hosting providers a way to reduce that risk, but they must apply the relevant updates; the reported findings alone do not establish that the flaws were exploited.

What to watch next

  • Whether PHP describes what its Oct 21 patch changed.
  • Whether PHP says users need to take any additional action.
  • Whether the reported X post said to have coined “Black October” can be found; Forkast.news says its searches covering Oct 21 to 23 found no matching post.

How it's being covered

Coverage analysisShow details
5 source articles · 5 unique outlets
Outlet political mix: Center Only· 4 Center · 1 unrated
Where the outlets are based: US/Canada 40% · Asia 40% · Other 20%
Outlet political mix
Center Only
Left
Center
Right
0 outlets
4 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
5 unique outletsDominant coverage: US/Canada
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (4 of 4 rated sources); comparatively few Left or Right-rated outlets have published on the event.
How we measure coverage

How outlets' accounts compare

Updat3 does not yet have enough full reports to compare how outlets framed this story.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Rasmus Lerdorf created the tools that became PHP in 1994, initially to manage his personal web page.
    Background · from our historical context
  2. In June 1995, he released the code publicly as Personal Home Page Tools.
    Background · from our historical context
  3. PHP made its first public release.
    Background · compiled and fact-checked by Updat3
  4. PHP released version 3, which established the language’s modern form.
    Background · compiled and fact-checked by Updat3
  5. Andi Gutmans and Zeev Suraski later rewrote the parser; PHP 3, released in June 1998, established the name PHP: Hypertext Preprocessor.
    Background · from our historical context
  6. Their work on the Zend Engine became the basis of PHP 4, released in May 2000.
    Background · from our historical context
  7. PHP released version 5 with the Zend Engine 2 and a revised object-oriented programming model.
    Background · compiled and fact-checked by Updat3
  8. Researchers disclosed CVE-2019-11043, a PHP-FPM vulnerability that could allow remote code execution in certain configurations.
    Background · compiled and fact-checked by Updat3
  9. The PHP Foundation was announced to fund PHP development and support its maintainers.
    Background · compiled and fact-checked by Updat3
  10. PHP maintainers issued fixes for CVE-2024-4577, a critical argument-injection flaw affecting PHP in CGI mode on Windows.
    Background · compiled and fact-checked by Updat3
  11. PHP released version 8.4.0.
    Background · compiled and fact-checked by Updat3
  12. Wiz Research found two PHP flaws on Aug 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.
    Reported in this story's sourcesSource:forkast.news

How we got here

PHP is an open-source programming language whose interpreter runs code on web servers and other systems. That position gives defects in the language a different reach from a flaw confined to one website: multiple applications may use the same PHP release, though exposure depends on the vulnerable code path and each application’s configuration.

Wiz Research identified two flaws in PHP, and PHP subsequently patched both. The available account does not give the discovery or disclosure dates, the affected versions, the security advisories or CVE identifiers, or the patch-release numbers. It therefore does not establish which applications were exposed or how the researchers reported the flaws to PHP’s maintainers.

Original sources

5 articles from 5 outlets

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.