AI-assisted discovery of critical PHP flaws prompts global patch push
October 21, 2026 at 05:29 PM · Updated 14h ago
7 reports · 2 in Arabic, 5 in English · over 12 hours
World leaders warn of security flaws found in PHP programming language
(opens the publisher’s site)
ثغرتان خطيرتان تهددان أمن مواقع الإنترنت حول العالم.. ما الذي حصل؟
(opens the publisher’s site)
Flaw in PHP computer language leads to shutdown of websites around world
(opens the publisher’s site)
PHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet
(opens the publisher’s site)
ثغرات أمنية تعطل مواقع حكومية في أوروبا وتهدد ملايين المواقع حول العالم
(opens the publisher’s site)
AI helped find a critical security flaw affecting 70% of the internet
(opens the publisher’s site)
Cyber chiefs tell websites to make critical safety update or go offline
(opens the publisher’s site)AI-assisted researchers have uncovered critical PHP vulnerabilities, dubbed PHP2Shell, that Wiz says could affect 70% of the internet, prompting global patch advisories.
- Researchers at OpenAI, Wiz, and security firm Calif disclosed Wednesday that AI helped discover the bugs.
- The PHP Foundation has released a patch and is urging website operators to update immediately.
- UK, EU, and Australian cybersecurity agencies urged PHP users to apply fixes or take vulnerable systems offline.
- Cloudflare CTO Dane Knecht said early attacks are emerging and mitigations are being updated.
- The U.S. National Security Agency issued a warning on the two PHP flaws, advising operators to take unpatched sites offline.
- Precautionary shutdowns and outages hit European government and corporate websites, including the Port of Rotterdam and sites in the Netherlands, Germany, Belgium, Finland, France and Denmark.
- Japan's cybersecurity agency joined European, British and Australian agencies in urging PHP users to update immediately.
- The PHP vulnerability was publicly disclosed on Tuesday, one day before the patch was issued.
- The two flaws, designated CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution.
- One of the PHP vulnerabilities traces its origins back to 2024, according to the researchers.
- The two PHP vulnerabilities date back decades, according to the researchers who identified them.
- Authorities across Asia took government websites offline in response to the disclosure, joining European counterparts.