PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched

PHP developers have released emergency updates for two critical vulnerabilities after cybersecurity authorities warned organizations to patch immediately or consider taking exposed applications offline.
Decrypt

PHP Panic: Two Critical Bugs Put 70% of the Internet at Risk, and Everyone Is Freaking Out

Two critical bugs in PHP, the language running most of the web, let strangers take over servers without a password.

PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

This is the kind of security issue that was found and prevented by AI, but is also a high risk because of AI.
LWN.net

PHP patches released for two critical RCEs

The PHP project has published PHP versions 8.5.12 , 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities that could allow unauthenticated remote code execution.
The Next Web

PHP rushes out emergency patches for two critical bugs AI found first

OpenAI calls PHP2Shell ‘one of the most impactful security issues in recent memory’, and says frontier AI found it before attackers did.

Critical flaw in PHP, banks shut down | Fixes only for 8.2 and above, check your site's version today | 10/22-Extra Edition

Key points of this newsOn the 21st, the IPA announced that a critical vulnerability had been found in PHP, a programming language used by about 70% of websites. The developers released a fix at 11:00 PM Japan time on the 21st,
Notebookcheck

PHP2Shell: Critical PHP flaws hit mod_php servers hardest

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated code execution, in some setups before any application code runs. Here is what goes wrong in the interpreter, which SAPIs are most exposed and which interim mitigations PHP recommends.