Thomas

Today's PHP disclosure is by the way a good example of why we at Dusk have invested so much time in making continuous AI-assisted audits and reviews part of how we build. PHP patched two critical bugs, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in. One sits in how PHP cleans up after running out of memory. The other is state that survives from one request to the next after its memory has been freed. The oldest affected code goes back to PHP 5.4 in 2012. Calif and Wiz found them independently using AI. Calif did it with no special setup and only models anyone can access. PHP runs a huge part of the web and a lot of people have looked at its code over the years, yet these bugs sat there for over a decade. Getting the fixes right took the PHP team weeks. This won't be the last case like it. The same tools are available to attackers, and a lot of older code has never been looked at this deeply, as the speed at which AI can inspect, test and validate invariants is impossible for a human to match. It also matches what we see in our own stack. Most of what turns up is in code written before we had these tools, so that's where we've put the majority of our focus, going back through all of our older code. The fixes go out in our public repos, like the Phoenix release below. The tools only get you so far. Finding bugs is a numbers game in the end, and with enough compute you'll find something in almost any codebase. The hard part is understanding what you found and which invariants matter in the first place. Without that you end up with fixes that don't hold up. A bad fix is dangerous because it gives people a false sense of safety. Judging what's a real issue and fixing it properly still takes people who know what they're doing, especially when dealing with cryptography. That costs a lot of time, testing and compute upfront. Our bet is that it pays off in the long run though. CVEs for reference: github.com/php/php-src/secur… github.com/php/php-src/secur…