Chip scarcity assaults auto industry amid the worsening Nexperia and DRAM crisis
The PHP Foundation has released patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix the vulnerabilities. PHP 8.1 and older versions will not receive official fixes. The coordinated release was originally scheduled for Oct. 22, but was brought forward to Oct. 21 following premature disclosures on Oct. 20, which led to public outcry.
OpenAI says every site using PHP can now safely upgrade its version to stay secure. The company highlights the incident — which it considers one of the biggest cybersecurity discoveries of 2026, given PHP’s ubiquity — as an example of the Defender's Window concept in action. OpenAI introduced the concept after its models hacked Hugging Face ; it describes a critical, narrow timeframe during which organizations can use advanced frontier AI models to find, patch, and strengthen their cybersecurity defenses before those same AI-driven attack capabilities become widely available to malicious threat actors.
Operating as part of the Patch the Planet program, researchers from Calif, a California-based cybersecurity firm and the program's founding partner, began auditing PHP with OpenAI tools on July 30, 2026, at the PHP Foundation's request. The Foundation had known about the underlying flaw since 2024 but couldn't identify an exploitation method or a fix. Calif researcher Ryan A. first identified the exploitable vulnerability on Aug. 11, followed by OpenAI researchers that same day. Subsequently, another cybersecurity firm, Wiz, independently identified an additional vulnerability.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, involve flaws in how PHP manages computer memory and handles errors. The first occurs when PHP runs out of allocated memory while processing a request, potentially leaving behind incomplete internal data that the engine may later mistakenly treat as valid. The second involves a related problem in which a fatal error leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it. Under certain conditions, attackers can exploit these weaknesses remotely — without needing login credentials — to execute malicious code on affected servers, potentially taking control of websites.
Hackers breach OpenAI using Claude tools, gaining access to employee accounts and the company's internal codebase
OpenAI's HuggingFace breach heralds an unprecedented age of AI cyber warfare
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/openai-says-gpt-5-6-sol-helped-uncover-critical-php-flaws-that-could-affect-70-percent-of-websites-ai-assisted-researchers-turned-two-year-old-bug-that-stumped-human-developers-into-working-exploits-in-two-weeks#main
- https://www.tomshardware.com/membership
- Micron's Taiwan union will launch a one-day strike this week, threatening memory production
- Leading European Financial Services Organizations Embrace Open Models to Build Proprietary Intelligence
- Buy a complete RTX 5070 Ti gaming PC from Newegg and save $450
- 480,000 phishing emails sent from a PC hidden behind a fridge in a Japanese hotel room
- Pioneers Across Europe Deploy NVIDIA Earth-2 Open Models to Power Real-World Weather and Climate Prediction
Informational only. No financial advice. Do your own research.