PHP maintainers knew of critical flaw for two years, report says
Critical remote code execution vulnerability discovered by AI agent exploited in the wild; 73% of installations on unsupported versions
A critical vulnerability in PHP, exploited in an attack chain that also used Fragnesia to gain kernel-level access to 25 servers seemingly linked to the US government, was known to a small team of maintainers for two years before it was made public, according to a post-mortem from the PHP Foundation. The vulnerability was discovered by OpenAI's GPT 5.6-Sol AI agent in October 2026.