AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
The flaws rate 9.2 out of 10 and could let attackers run code on servers without a login, researchers and officials said.
- On Wednesday, October 21, 2026, the PHP Foundation released emergency updates to patch two critical remote-code-execution vulnerabilities affecting the widely used programming language. Maintainers urged administrators to update systems immediately.
- Researchers at security firm Calif and Wiz discovered the flaws using AI models in August, marking a shift in vulnerability detection. PHP underpins roughly 75% of identified websites, creating systemic risk across WordPress, Drupal, and Magento platforms.
- Rated 9.2 in severity on the CVSS v4.0 scale, the 'PHP2Shell' vulnerabilities allow unauthenticated attackers to execute malicious code. Cloudflare Chief Technology Officer Dane Knecht reported the company was "seeing early attacks emerging" and updating firewall rules.
- Following warnings from the European Union Computer Emergency Response Team and the National Security Agency , organizations were advised to isolate internet-facing applications. Government websites in the Netherlands and Finland proactively went offline Wednesday as a precautionary measure.
- Describing the current patching process as "slow and manual," OpenAI President Greg Brockman warned that AI-driven vulnerability discovery will likely accelerate in the coming months. Security experts are now bracing for a "race to exploit" as attackers scan for unupdated servers.
706 Articles
706 Articles
Global alert over two critical PHP flaws forces government websites offline
Governments and companies in several countries temporarily took websites offline this week over two critical vulnerabilities in PHP, the programming language that powers much of the internet, which allow an attacker to run code remotely on servers without authenticating. PHP’s development team released fixes on Wednesday and urged users to update immediately.
After becoming aware of a serious security vulnerability in the web programming language PHP, government authorities and companies around the world have precautionarily shut down numerous websites. In Europe, among others, websites in Germany, France, the Netherlands and Belgium were affected on Wednesday. The US intelligence service National Security Agency (NSA) and the Federal Office for Information Security (BSI) in Bonn had urgently advised…
Up to 70% of world's websites at risk after AI finds security flaw
Much of the internet could be vulnerable to hackers, according to the creators of the technology that powers a massive chunk of cyberspace. The creators of PHP, which powers as much as 70% of the world’s websites, said Wednesday that its system is facing a critical security problem that hackers could use to take control […]
9NEWS Denver
Massive security flaw detected in web programming language forces many websites offline
Governments and other organizations in Europe and the U.S. took their websites offline temporarily Wednesday as they scrambled to fix a major security flaw.
Coverage Details
Bias Distribution
- 41% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
