1 source filed · EN 1
Four exploitable bugs under two CVEs (CVE-2026-109618, CVE-2026-109619): an upload-progress unserializer use-after-free, a process-memory disclosure via the PHPSESSID cookie, a fatal-error backtrace use-after-free and an OPcache type confusion.
5.4oldest PHP version affected by at least one of the bugs
1 source filed · JA 1
Same code, prompt and tools for each model; two runs each, up to 60 minutes and 30 model calls per run, with no carry-over between runs.
16candidate vulnerabilities reported across the four models
1 source filed · EN 1
Three tiers: Defense Access (SOC, incident response, malware reverse-engineering; response to applications within a few days), Red Team Access (adds authorised penetration testing; organisations only; review takes a few weeks), Specialized Access (fewest blocks; safety-critical systems such as power grids and interbank infrastructure; reviewed with the US government).
129,000verified software vulnerabilities partners reported finding with Claude Mythos, April-July 2026