Two remote code execution vulnerabilities in the PHP 8.x line have been patched after security researchers accidentally exposed details of the flaws before the official patch was released. The issues were discovered by Wiz Research in August using artificial intelligence tools, including Gemini and GPT-5.6 Sol, and reported to the PHP security team in September. A coordinated disclosure process was intended to give developers time to prepare, but a leak occurred when a security firm mistakenly published a video demonstration of the exploits on October 20. This premature release gave attackers immediate access to proof of concept code, forcing the PHP Foundation to move the public announcement forward by a day to mitigate damage.
The incident highlights the risks of automated security research when combined with flawed disclosure protocols. While AI can accelerate the discovery of critical bugs, the resulting speed can overwhelm human coordination mechanisms. The accelerated timeline reduced the window for vendors to test patches against real-world environments before they went live. This situation underscores the need for stricter controls on how vulnerability data is shared during the development phase.
- Wiz Research identified the flaws using a combination of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
- The initial CVSS score was incorrectly listed as 10.0 before being corrected to 9.2.
- Exploitation code began circulating on social media within hours of the accidental video leak.
