Cyber securityReel #20 · 1 Nov 2026

AI ne pakda PHP ka bug: Google ne apna AI kyun chhupaya?

PHP2Shell: PHP core mein do critical bugs (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) jo bina login ek request se server par code chalwa sakte the, pichhle ~10 saal ke har PHP version mein. Wiz ne Google ke Gemini 4 Argon (aur GPT-5.6 Sol) ki madad se pakde. Patch (21 Oct) se 4 din pehle hamle shuru, 20 Oct ko leak, kai European sarkaron ne sites band ki, 25+ Palo Alto firewalls par kabza. Ab Google ka Gemini 4 Carbon aur bhi taaqatwar hai, isliye pehle sirf cyber defenders ko mil raha hai.

Links

Wiz: PHP2Shell Discovery with Gemini 4 Argon + GPT-5.6 Sol, CVEs, fixed versions

PHP2Shell timeline (Wikipedia) Leak, early exploitation, government shutdowns

SecurityWeek: Palo Alto firewalls, WordPress 25+ firewalls rooted; 77,000+ WordPress requests, no confirmed compromise

The Hacker News: exploited 4 days early Exploit attempts before disclosure

Google: Gemini 4 Carbon 88.2% / 71% benchmarks, defenders-first rollout

Chrome fix credited to Claude Critical Chrome bug reported by Anthropic with Claude

Aaj ye karo

Hosting panel mein apni website ka PHP version check karo (ya server par: php -v).
PHP ko fixed version par update karo: 8.5.12, 8.4.27, 8.3.36, 8.2.35 ya naya. 8.1 ya purana (end-of-life) hai toh supported version par upgrade karo.
WordPress site hai toh bhi PHP update zaroori hai: WordPress update akela kaafi nahi.

php -v

Sources

Wiz, Wikipedia, SecurityWeek, The Hacker News, CNBC, Google, AI Business; 1 Nov 2026 ko check kiya.