Two severe vulnerabilities affecting PHP versions back to 5.4 have been disclosed.

While the PHP Foundation released patches for PHP 8.2 and newer, older versions remain exposed, prompting security advisories to isolate internet-facing applications.

How the problem was discovered

The case began on Tuesday after an anonymous tip on the Hacker News platform about issues that allowed unknown parties to remotely execute commands without a password. The PHP Foundation, the group that maintains the language, officially confirmed the flaws and called on administrators to take immediate action.

Experts from security firm Wiz said the flaw had been around for more than a decade, calling it one of the most serious vulnerabilities ever found in software. Notably, the flaws were discovered using artificial intelligence models from OpenAI, as well as research teams from Wiz and Calif.…