AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
AI-assisted research uncovered flaws that could let attackers run code without logging in, prompting urgent patches and precautionary shutdowns across government and public websites.
- On Wednesday, October 21, 2026, the PHP Foundation released emergency updates to patch two critical remote-code-execution vulnerabilities affecting the widely used programming language. Maintainers urged administrators to update systems immediately.
- Researchers at security firm Calif and Wiz discovered the flaws using AI models in August, marking a shift in vulnerability detection. PHP underpins roughly 75% of identified websites, creating systemic risk across WordPress, Drupal, and Magento platforms.
- Rated 9.2 in severity on the CVSS v4.0 scale, the 'PHP2Shell' vulnerabilities allow unauthenticated attackers to execute malicious code. Cloudflare Chief Technology Officer Dane Knecht reported the company was "seeing early attacks emerging" and updating firewall rules.
- Following warnings from the European Union Computer Emergency Response Team and the National Security Agency , organizations were advised to isolate internet-facing applications. Government websites in the Netherlands and Finland proactively went offline Wednesday as a precautionary measure.
- Describing the current patching process as "slow and manual," OpenAI President Greg Brockman warned that AI-driven vulnerability discovery will likely accelerate in the coming months. Security experts are now bracing for a "race to exploit" as attackers scan for unupdated servers.
733 Articles
733 Articles
Government agencies and companies worldwide are rushing to shut down websites or temporarily suspend online services after two critical security vulnerabilities were discovered in the PHP programming language, which is used by many websites around the globe.
Global alert over two critical PHP flaws forces government websites offline
Governments and companies in several countries temporarily took websites offline this week over two critical vulnerabilities in PHP, the programming language that powers much of the internet, which allow an attacker to run code remotely on servers without authenticating. PHP’s development team released fixes on Wednesday and urged users to update immediately.
After becoming aware of a serious security vulnerability in the web programming language PHP, government authorities and companies around the world have precautionarily shut down numerous websites. In Europe, among others, websites in Germany, France, the Netherlands and Belgium were affected on Wednesday. The US intelligence service National Security Agency (NSA) and the Federal Office for Information Security (BSI) in Bonn had urgently advised…
Coverage Details
Bias Distribution
- 41% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
