diff --git a/source/_posts/2026-10-21-todays-php-security-release-and-how-were-strengthening-php-security.md b/source/_posts/2026-10-21-todays-php-security-release-and-how-were-strengthening-php-security.md index 3194402d..b65cf10a 100644 --- a/source/_posts/2026-10-21-todays-php-security-release-and-how-were-strengthening-php-security.md +++ b/source/_posts/2026-10-21-todays-php-security-release-and-how-were-strengthening-php-security.md @@ -32,7 +32,7 @@ Over the last months the way PHP security work is organized has changed consider Earlier this year, we worked with [Alpha-Omega](https://alpha-omega.dev/) to scan PHP with Anthropic's Claude Mythos. But since the Mythos scan, we have added other tools, including OpenAI's Daybreak Red for validating reports and exploits, alongside sanitizer builds and reproduction environments that match our CI on every platform PHP supports. -The PHP Foundation got the PHP project into the [Patch the Planet](https://openai.com/index/patch-the-planet/) program, as part of which security firm [Calif](https://calif.io/) began an audit of PHP on July 30th, 2026\. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024\. [OpenAI](https://openai.com/) independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from [Wiz](https://www.wiz.io/) on August 24th. More recently, [Trail of Bits](https://trailofbits.com/) has also been auditing PHP. The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation's team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties. +The PHP Foundation got the PHP project into the [Patch the Planet](https://openai.com/index/patch-the-planet/) program, as part of which security firm [Calif](https://calif.io/) began an audit of PHP on July 30th, 2026. On August 11th, researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. [OpenAI](https://openai.com/) independently reported the same root cause, followed by further attack vectors from OpenAI on September 18th and from [Wiz](https://www.wiz.io/) on August 24th. More recently, [Trail of Bits](https://trailofbits.com/) has also been auditing PHP. The reports from Calif, OpenAI, and Wiz made the full impact of the OOM problem clear, and from August 11th onward, fixing it became the top priority for all of the PHP Foundation's team working on security. Without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties. The growth of AI-assisted research also means the PHP security team receives far more reports than before. As Alexandre Daubois described last week in [How the PHP Security Team Handles Your Reports](https://thephp.foundation/blog/2026/10/14/how-the-php-security-team-handles-your-reports/), the team has published 15 CVEs since July 1st and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch.