Security5d ago
OpenAI Discloses PHP Zero-Day Critical Flaws Found via GPT-5.6 Sol, Open-Sources Scanner and Pledges $1B Defense Fund
OpenAI announced a critical coordinated vulnerability disclosure in the core PHP runtime discovered by cybersecurity firm Calif utilizing GPT-5.6 Sol, alongside independent verification by Wiz. Because PHP powers roughly 70% of all websites globally, the vulnerability represented an existential risk to internet infrastructure. Following coordinated patching, OpenAI committed $1B in subsidized Daybreak security access and open-sourced openai/php2shell-checker, an automated Codex inspection tool enabling site administrators worldwide to audit their deployments.
Industry22d ago
Google pauses product-vulnerability payouts in its OSS VRP after a flood of automated AI submissions; $500–$7,500 band zeroed, update promised in Q1 2027
Google's Open Source Software Vulnerability Reward Program stopped accepting product-vulnerability reports on October 1, 2026, citing a significant rise in automated submissions that are mostly invalid. Commit f8bf23ad8 in google/bughunters (Sept 30) replaced the product-vulnerability reward bands ($500–$7,500 for flagship projects, $101–$3,133.7 for important ones) with dashes, while supply-chain compromise rewards stay at up to $31,337. Reports filed before Oct 1 are unaffected, some Google Cloud repos can route via Cloud VRP, and Google promises an update in Q1 2027.
Tooling2d ago
MCP reference servers v2.1.0 fix eight vulnerabilities: upgrade filesystem and everything to 2.0.1 and fetch to 2026.10.24
On Oct 25 (UTC) the official Model Context Protocol servers repo shipped v2.1.0, fixing eight vulnerabilities in three reference servers: symlink races, trailing quote/whitespace path bypasses and case-insensitive symlink bypasses in filesystem; cross-origin calls over HTTP/SSE in everything; and IDNA host-name and NAT64 internal-address reachability plus robots.txt not rechecked after redirects in fetch. The maintainers warn that npm users still on date versions (2025.x/2026.x) will not be offered the upgrade and must install 2.0.1 explicitly, and that the filesystem write issue is only partly fixed on Windows.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.