Wiz

PHP

2026-10-21 17:54:58

Critical PHP flaw exposes websites worldwide as older versions remain unpatched

PHP, the server-side language used by roughly 70% of the world’s websites, has been hit by two critical vulnerabilities that can let unauthenticated attackers execute code remotely on web servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and grouped under the name PHP2Shell, were serious enough for PHP to issue emergency fixes the same day. Even so, more than one-third of the web was still unpatched at publication because official fixed releases initially covered only PHP 8.2 and newer, while backports for versions 7.4 through 8.1 were only beginning to roll out. According to the report, more than 800,000 internet hosts that serve content to millions of websites run PHP branches so old that they are not expected to receive any fix at all. The issue was discovered during an August audit funded by OpenAI, with the researcher using OpenAI’s GPT-5.6 Sol model. Calif, part of OpenAI’s Patch the Planet program, was involved, and Wiz independently confirmed the flaws. Cloudflare said live exploit vectors were seen across all customers, including free plans, and deployed emergency mitigations overnight. Government web services in Finland and the Netherlands were also taken offline as a precaution or affected during the response.

50

OpenAI

2026-10-21 14:56:15

OpenAI says its model helped uncover major PHP flaws as emergency patches roll out

OpenAI said its model-assisted research helped uncover a critical security issue in PHP, the open-source language it said powers roughly 70% of websites worldwide. The company said Calif used GPT-5.6 Sol to identify the flaw under its "Patch the Planet" program, while security firm Wiz independently found and reported two unauthorized remote code execution bugs. Those issues, referred to together as "PHP2Shell," were assigned CVE-2026-109618 and CVE-2026-109619, according to BleepingComputer. PHP maintainers have released emergency fixes for supported branches, while Cloudflare said it had already deployed web application firewall protections before public disclosure and had seen early attack attempts. The UK’s National Cyber Security Centre urged immediate updates. OpenAI also announced a $1 billion "Daybreak for Frontline Defenders" subsidy program aimed at organizations with limited resources that protect critical services. The company said the case led it to outline a five-stage response framework for high-impact vulnerabilities in the AI era, and added that it coordinated with U.S. and international partners during the PHP response process.

40

Rust

2026-08-21 02:54:54

Malicious Rust packages were live for 86 minutes, affecting tools used across Solana and Ethereum

Attackers pushed malicious versions of three widely used Rust packages in a supply-chain attack, according to Cryptopolitan. One of the compromised libraries, arrayref, is used by roughly three-quarters of Rust development environments. The malicious update concealed a backdoor that could automatically steal login credentials when users compiled projects, potentially exposing both machines and keys for anyone who built affected versions. Wiz researchers said the command-and-control path tied to the arrayref attack overlapped with infrastructure linked to the Mastra campaign used by North Korean hacking group Sapphire Sleet and UNC1069. The IP addresses shared the same security certificate and used the same hosting provider, Hostwinds. The attacker did not alter the original codebase. Instead, they added a typo-squatted dependency, proc-macro1, designed to resemble the popular proc-macro2, allowing the package to pass tests and builds. The malicious release was removed 86 minutes after publication, but it had already been widely downloaded. The affected packages are broadly used in Solana and Ethereum tooling, and the Rust team believes the maintainers were not acting maliciously, with their devices or credentials possibly compromised.

1200

OpenAI

2026-08-14 10:07:04

OpenAI CRO Denise Dresser exits as former Wiz president Dali Rajic steps in before IPO

OpenAI has made another senior leadership change as it moves toward an IPO. According to TechCrunch and Axios, chief revenue officer Denise Dresser is leaving the company less than a year after taking the role, with former Wiz president and chief operating officer Dali Rajic set to replace her. Dresser, a former Slack executive, spent about nine months in the post after joining OpenAI last year. Rajic comes from Wiz, the cloud security company that was acquired by Google in 2026 for $32 billion. The move marks OpenAI’s second executive departure in a matter of days and its third major leadership change in roughly six months. Brad Lightcap, who had served as chief operating officer, recently said he was leaving to pursue 「something new」. Earlier, in July, Fidji Simo, described in the report as the company’s No. 2 executive responsible for AGI deployment, also departed, with president Brockman taking on broader management responsibilities. These changes are unfolding after OpenAI confidentially filed with the U.S. Securities and Exchange Commission for what could become one of the largest tech IPOs in history. The company reportedly has more than 1 billion weekly active users and 2 million enterprise customers.

1420

Google

2026-07-23 16:10:15

Google Closes $32 Billion Wiz Deal in Its Largest Acquisition Ever

Google has completed its $32 billion acquisition of cloud security platform Wiz, folding it into Google Cloud while keeping the Wiz brand and multi-cloud support intact. The deal is also reported as the largest exit in Israel’s tech sector.

600