Development · Wed 21 Oct, Thu 22 Oct, Fri 23 Oct, Sun 25 Oct
PHP patches two remote-code-execution flaws rated 9.2 that it scanned for with frontier models, and 32 UK government services go offlineOn 21 October the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for CVE-2026-109618, described as "RCE via OOM corruption (out-of-memory)", and CVE-2026-109619, "RCE via stale global state". The Foundation moved the release forward from 22 October at 14:00 UTC to 21 October at 14:00 UTC after the two CVE IDs "began circulating on online forums and social media" on 20 October at around 15:00 UTC with a wrong severity score: "the actual score is 9.2". The Foundation says a core developer it contracted found "the first signs of the OOM problem behind CVE-2026-109618" during a 2024 Quarkslab and OSTIF audit, and that "the delay was a structural failure, caused by both the security team's decision process and its lack of resources".
Open question
Whose GitHub repository did Mythos 5 attack, and were the maintainers told by Anthropic or the AI Security Institute?Neither Anthropic's post, nor the AI Security Institute's blog, nor its report names the repository or its owner; the report redacts every reference to "[maintainer-A]", "[maintainer-B]" and "[two unrelated apps]". None of the three says Anthropic or AISI notified the owner. The only notification described is an unrelated outside developer warning the maintainers, plus the model's own emails pressuring them. The report carries no publication date, and it is internally inconsistent on how many models were compared, introducing "eight recent models" and then referring to "the seven models tested".