# Source: PHP ออกแพตช์แก้ช่องโหว่ RCE ร้ายแรง 2 รายการที่ค้นพบด้วยโมเดล AI แนวหน้า – Unite.AI

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Unite.AI: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP ออกแพตช์แก้ช่องโหว่ RCE ร้ายแรง 2 รายการที่ค้นพบด้วยโมเดล AI แนวหน้า – Unite.AI

**Unite.AI** · [https://www.unite.ai/th/php-patches-two-critical-rce-flaws-found-with-frontier-ai-models/](https://www.unite.ai/th/php-patches-two-critical-rce-flaws-found-with-frontier-ai-models/) · published 2026-10-21 · added by `curator@php.newsroom` · slug `unite-th-php-patches-two-critical-rce-flaws-fo`

Promoted from the source watch (pack copy 7r83qic5), snapshot 20261023T080331Z, queue priority 4 (mechanical selection by researcher@php.newsroom, read by the curator). Unite.AI (Thai edition), 21 October: PHP patches two critical RCE flaws found with frontier AI models. Its stated byline is 'Miles Okada, AI research...

## What it says, as the collector read it

#### PHP ออกแพตช์แก้ช่องโหว่ RCE ร้ายแรง 2 รายการที่ค้นพบด้วยโมเดล AI แนวหน้า – Unite.AI

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`, read from its pack copy `7r83qic5`), page `ai/news/unite/th-php-patches-two-critical-rce-flaws-found-with-frontier-ai`, snapshot `20261023T080331Z`. Copied byte for byte; every file's sha256 is in `captures/20261023T080331Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Curator's reading of the capture._

Unite.AI (Thai edition), 21 October: PHP patches two critical RCE flaws found with frontier AI models. Its stated byline is 'Miles Okada, AI research agent', and it is a short item of 183 words by its own count. It says the PHP project published 8.5.12, 8.4.27, 8.3.36 and 8.2.35, that the advisory names PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed with the highest risk under mod_php, that no mitigation fully fixes the problem, and that Chainguard breached the embargo by several hours and published fixed images before the coordinated release. No new facts.

> Chainguard ละเมิดข้อตกลงห้ามเผยแพร่ก่อนกำหนดหลายชั่วโมงและเผยแพร่อิมเมจที่แก้ไขแล้วก่อนการเปิดตัวพร้อมกัน

_Curator's translation:_ "Chainguard breached the embargo by several hours and published fixed images before the coordinated release."

_The watch reader's summary (researcher@php.newsroom, of its snapshot 20261022T171501Z, not necessarily this one):_ Thai-language Unite.AI article summarising the PHP 8.5.12/8.4.27/8.3.36/8.2.35 release, the two CVEs, the affected SAPIs and mitigations. It retells the Wiz, Calif and OpenAI discovery timelines, the PHP Foundation's admission of a 'structural failure' and the Chainguard embargo break.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "PHP ออกแพตช์แก้ช่องโหว่ RCE ร้ายแรง 2 รายการที่ค้นพบด้วยโมเดล AI แนวหน้า – Unite.AI". Selected mechanically, not read by a person.

#### Capture notes

Language `th`. The byline states the article was written by an AI research agent: a statement about how the piece was made. Nothing in the article text addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261023T080331Z · HTTP 200 · https://www.unite.ai/th/php-patches-two-critical-rce-flaws-found-with-frontier-ai-models/- `headers.json` ac098e3562e488200995146518ff16f030473fa3f8e4e59aadc54612f7725713 1,678 bytes
- `page.html` 63f74377c21fc0ac71572623296b9d2112b27a3b254ee49fd1fb358b874cfda5 625,584 bytes
- `provenance.json` aca6efcf762f95a24120c01c01de0b18c8751b605737c7f15270ae0e3e987bf3 1,881 bytes
- `rendered.html` d3fb45e28f35f2960320239f7006b494629d1921a62821dc127a3121edee13e6 652,703 bytes
- `screenshot.jpg` e2d09bbe17eb7832ff97eb9052f0f95d8a43feaa8d6a3ef3073ff633a82314db 830,837 bytes
- `text.txt` 19eba2f1bec667e39df6fdb435995b7e1bc037f6e2b1740a3512ece81e477c04 29,739 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.45 · data as of 2026-10-27T09:43Z · vault commit 55b47c4d6af1 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/unite-th-php-patches-two-critical-rce-flaws-fo/index.html