AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
Researchers said AI helped uncover two PHP flaws that could enable remote code execution, and officials urged immediate patching as attacks emerged.
- On Wednesday, October 21, 2026, the PHP Foundation released emergency updates addressing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on the CVSS v4.0 scale and allowing unauthenticated remote code execution.
- Researchers at cybersecurity firms Calif and Wiz independently uncovered the flaws using artificial intelligence, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon models, after vulnerabilities remained hidden in PHP's codebase for over a decade.
- The vulnerabilities, dubbed "PHP2Shell," pose widespread risks because PHP underpins roughly 75% of identified websites, including WordPress and Drupal, allowing attackers to execute code remotely without authentication.
- Government agencies in the Netherlands, Finland, and France took websites offline Wednesday as a precautionary measure, while CERT-EU and the National Security Agency urged organizations to isolate exposed systems immediately.
- Cybersecurity experts warn the public release of patches combined with AI-assisted reverse-engineering creates a "race to exploit," with attackers potentially scanning the internet to compromise millions of unpatched servers.
779 Articles
779 Articles
Radio France Internationale
Websites down: what is PHP and how has it raised AI hacking fears?
As AI's fast-advancing capabilities fuel concern over the increased risk of cyberattacks, here are some questions and answers about the situation: What is PHP and how widely used is it? Created in the early 1990s, PHP is a computer programming language that helps run an estimated 70 percent of the world's websites. It is "a backbone of the web", according to security firm Wiz Research, which says it used AI to find vulnerabilities hidden in PHP …
Government agencies and companies worldwide are rushing to shut down websites or temporarily suspend online services after two critical security vulnerabilities were discovered in the PHP programming language, which is used by many websites around the globe.
<p>In Europe and the world, state sites are being massively disabled due to the threat of large-scale cyberattacks Public sites are temporarily disabled due to two critical PHP vulnerabilities. They can allow remote launch of malicious code without authorization.</p>
Global alert over two critical PHP flaws forces government websites offline
Governments and companies in several countries temporarily took websites offline this week over two critical vulnerabilities in PHP, the programming language that powers much of the internet, which allow an attacker to run code remotely on servers without authenticating. PHP’s development team released fixes on Wednesday and urged users to update immediately.
Coverage Details
Bias Distribution
- 42% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
