AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
- On Wednesday, October 21, 2026, the PHP Foundation released emergency updates to patch two critical remote-code-execution vulnerabilities affecting the widely used programming language. Maintainers urged administrators to update systems immediately.
- Researchers at security firm Calif and Wiz discovered the flaws using AI models in August, marking a shift in vulnerability detection. PHP underpins roughly 75% of identified websites, creating systemic risk across WordPress, Drupal, and Magento platforms.
- Rated 9.2 in severity on the CVSS v4.0 scale, the 'PHP2Shell' vulnerabilities allow unauthenticated attackers to execute malicious code. Cloudflare Chief Technology Officer Dane Knecht reported the company was "seeing early attacks emerging" and updating firewall rules.
- Following warnings from the European Union Computer Emergency Response Team and the National Security Agency , organizations were advised to isolate internet-facing applications. Government websites in the Netherlands and Finland proactively went offline Wednesday as a precautionary measure.
- Describing the current patching process as "slow and manual," OpenAI President Greg Brockman warned that AI-driven vulnerability discovery will likely accelerate in the coming months. Security experts are now bracing for a "race to exploit" as attackers scan for unupdated servers.
619 Articles
619 Articles
AI helped find a critical bug affecting huge swathes of the internet
Newly announced vulnerabilities could affect broad swathes of the internet after being discovered by teams of cybersecurity professionals—with heavy AI assistance. The issues affect PHP, a widely-used open-source programming language that provides a foundation for content management systems like WordPress, which powers a broad array of websites (including those of the Center for Investigative Reporting). […]
Two critical vulnerabilities in PHP have put websites, online stores and government applications at risk around the world. The language's developers have released emergency patches after it became clear that the weaknesses could allow remote code execution without user authentication. The issues are labeled CVE-2026-109618 and CVE-2026-109619 and are rated 9.2 out of 10 on the CVSS v4.0 scale. According to the PHP team, they affect all installat…
Suspensions were precautionary measures, as they left sites vulnerable to cyberattacks but not so long as the attacks were carried out. Failures were identified using OpenAI's AI program.
In Europe, many government, school, and hospital websites have been taken offline to protect against two critical security vulnerabilities in the PHP programming language, which powers a large portion of the internet. Meanwhile, the Cybersecurity Directorate has launched national-level preventative security efforts targeting critical vulnerabilities identified in the PHP software infrastructure, widely used in websites and corporate applications…
Coverage Details
Bias Distribution
- 39% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
