Two critical PHP vulnerabilities reported in October 2026 permit remote code execution without requiring user authentication

Overview Debates Related claims Topics

Two critical PHP vulnerabilities were discovered by OpenAI's 'Patch the Planet' initiative working with a California-based AI security firm using GPT-5.6

The National Security Agency issued a public advisory warning organizations to prepare for updates addressing two critical vulnerabilities in PHP

Indian certificate authority eMudhra issued digital certificates signed with weak private keys

Two PHP vulnerabilities allow unauthenticated attackers to remotely execute arbitrary code on exposed web servers

Japanese cybersecurity government officials issued a public advisory instructing organizations to patch vulnerable PHP installations

Third-party auditors audited eMudhra twice while the certificate authority was actively signing certificates with weak private keys

Security researchers from Wiz and OpenAI discovered two remote code execution vulnerabilities in PHP

Cryptographer Paul Miller released software patches addressing code vulnerabilities identified using the Kimmy K3 artificial intelligence model

Hardware hacker Joe Grand verified that a Ledger Nano X purchased in Thailand contained unauthorized wiring and an added circuit board

On October 9, 2026, cryptocurrency wallets associated with compromised Ledger devices began being drained of funds

In June 2026, a security researcher in Japan observed at least 90 compromised Ledger devices exfiltrating seed phrases remotely

Single-signature Coldcard Bitcoin wallets that utilized single-word or short numerical passphrases were compromised during the July 29, 2026 Coldcard exploit

OpenSats established a dedicated Red Team fund to support open-source cybersecurity research

The 2026 Ledger security failure was caused by a physical supply chain interception rather than a cryptographic entropy defect

On October 10, 2026, Ledger confirmed the presence of unauthorized physical implants inside affected customer devices

Entering a passphrase or using dice rolls to generate keys on a compromised Ledger does not prevent theft because an unauthorized hardware implant intercepts all screen and button data

The Bitcoin Red Team spent between $20,000 and $25,000 running AI security scans specifically on the libsecp256k1 cryptographic library

The initial attacker in the Coldcard hardware wallet firmware exploit stole over 100 million dollars worth of Bitcoin

Compromised Ledger devices passed official software genuine checks because the factory secure element remained unaltered

AI security scans of the libsecp256k1 cryptographic library identified no critical vulnerabilities