AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
PHP developers released emergency patches after AI-assisted research found flaws that could let attackers seize servers without a password, officials said.
- On Wednesday, October 21, 2026, PHP developers released emergency security patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, after cybersecurity agencies worldwide urged immediate updates or offline precautions.
- Cybersecurity firms Calif and Wiz discovered the decade-old flaws using artificial intelligence tools in August 2026, marking what researchers describe as an 'AI inflection point' in vulnerability discovery.
- Rated 9.2 on the CVSS v4.0 scale, both vulnerabilities enable unauthenticated remote code execution on PHP, which powers roughly 70% of websites globally, creating massive exploitation potential.
- Government agencies in France, the Netherlands, and Finland, alongside Wikipedia, temporarily took systems offline Wednesday as precautionary measures while operators applied security patches.
- Experts warn that AI tools now lower the barrier for attackers to rapidly reverse-engineer exploits, marking a critical phase where AI-driven discovery transforms longstanding flaws into systemic global risks.
934 Articles
934 Articles
70% of websites face catastrophic hijacking under newly discovered flaw
A critical software crisis has emerged after artificial intelligence uncovered a severe vulnerability in PHP, the code powering up to 70% of the world's websites. Named PHP2Shell, the memory management flaw allows hackers to gain control of unpatched servers within seconds. Security experts reported by The Wall Street Journal are rushing to install patches before automated AI tools are weaponized by cybercriminals. The post 70% of websites face …
abc 6 Philadelphia
abc30 NewsSome websites shut down globally as operators address PHP issue after AI finds critical flaw
The US National Security Agency and Europe's cybersecurity agency on Wednesday advised companies to take immediate action to address two critical flaws in PHP
Critical security flaw shuts down websites worldwide
WASHINGTON — Government and company websites around the globe have gone dark and suspended some services after a serious vulnerability was found in a computer language used to build much of the world wide web, with organizations scrambling to fix the critical security flaw.Belgian, Dutch, Finnish, French and German sites were among those that governments took down temporarily as they scrambled to patch the critical weakness in PHP, a language us…
A critical security flaw in the PHP programming language has forced public institutions and businesses in several countries around the world to temporarily shut down their websites to protect their systems from potential cyberattacks. The vulnerability affects a technology widely used to build and operate websites. According to cybersecurity company Cloudflare, about 70% of websites use PHP, which also supports popular platforms such as WordPres…
Two critical security vulnerabilities discovered in the PHP infrastructure, used in websites and corporate applications worldwide, have become a topic of discussion. The Cybersecurity Directorate announced that examinations conducted on the e-Government Portal did not reveal any issues that negatively affect the security of services.
Coverage Details
Bias Distribution
- 41% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
