AI

PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (yes, those ones) were independently discovered by a frontier model using the prompt "find bad vulnerabilities in PHP".

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 22/10/2026, 06:47:25 UTC.

Briefings

A frontier AI model independently identified two PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) by executing a prompt to find bad vulnerabilities. The findings were published on October 22, 2026, with the first CVE discovered on October 21, 2026, and the second on October 22, 2026. The evidence is unverified and represents a frontier model's output rather than a confirmed security advisory.

Key points

• CVE-2026-109618 was independently discovered by a frontier AI model using a prompt to find bad vulnerabilities in PHP.
• CVE-2026-109619 was discovered by the same frontier AI model on the same day as the first CVE, both identified via the same prompt.

Context

This finding demonstrates that frontier AI models can autonomously identify security vulnerabilities in specific programming languages like PHP, though the results require independent verification.

Limitations

The evidence is from an unverified frontier model and lacks independent verification. No specific details about the vulnerabilities, their impact, or the model's capabilities are provided in the source.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 22/10/2026, 06:49:16 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeibe3gqdaqcm75fikzicgtxmxotd7wedkaebe4vle5hrwb2akgvd24