AI turned a decade-old PHP flaw into a working exploit
CVE-2026-109618 and CVE-2026-109619 sat in PHP's error handling since version 5.4 in 2012. Frontier models collapsed the effort to exploit them, and the patch arrived only after a leaked CVE number, a misplaced video, and a broken embargo.