AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
Researchers said the flaws can enable remote code execution and memory disclosure, and website operators are being urged to update immediately.
- On Wednesday, October 21, 2026, the PHP Foundation released emergency updates to patch two critical remote-code-execution vulnerabilities affecting the widely used programming language. Maintainers urged administrators to update systems immediately.
- Researchers at security firm Calif and Wiz discovered the flaws using AI models in August, marking a shift in vulnerability detection. PHP underpins roughly 75% of identified websites, creating systemic risk across WordPress, Drupal, and Magento platforms.
- Rated 9.2 in severity on the CVSS v4.0 scale, the 'PHP2Shell' vulnerabilities allow unauthenticated attackers to execute malicious code. Cloudflare Chief Technology Officer Dane Knecht reported the company was "seeing early attacks emerging" and updating firewall rules.
- Following warnings from the European Union Computer Emergency Response Team and the National Security Agency , organizations were advised to isolate internet-facing applications. Government websites in the Netherlands and Finland proactively went offline Wednesday as a precautionary measure.
- Describing the current patching process as "slow and manual," OpenAI President Greg Brockman warned that AI-driven vulnerability discovery will likely accelerate in the coming months. Security experts are now bracing for a "race to exploit" as attackers scan for unupdated servers.
642 Articles
642 Articles
Internet races to fend off newly discovered security flaws
{beacon} Technology Technology The Big Story Internet races to fend off newly discovered security flaws The National Security Agency (NSA) warned organizations Wednesday to immediately patch a pair of security flaws or take their systems offline after artificial intelligence discovered vulnerabilities in a key programming language. © AP Photo/Patrick Semansky, File “Effective Immediately, all...
Washington Times
The New York LedgerGovernment websites in Europe go offline as companies update software flaw
The home page of the lower house of the Dutch parliament was among scores of government websites throughout Europe taken offline as a precautionary measure following the discovery of vulnerabilities in PHP, the programming language used to build websites.
![[your]NEWS](/_next/image?url=https%3A%2F%2Fgroundnews.b-cdn.net%2Finterests%2Ffb6dc495f74049f513563c33352175eaa0ecd509.jpg%3Fwidth%3D24&w=64&q=75){kind=small}
AI-Discovered PHP Security Flaws Force Government Websites Offline as Developers Release Emergency Fixes
Two critical vulnerabilities in the programming language PHP prompted emergency security warnings and temporary website shutdowns Wednesday, as developers released updates to prevent attackers from ... The post AI-Discovered PHP Security Flaws Force Government Websites Offline as Developers Release Emergency Fixes first appeared on [your]NEWS.
AI helped find a critical bug affecting huge swathes of the internet
Newly announced vulnerabilities could affect broad swathes of the internet after being discovered by teams of cybersecurity professionals—with heavy AI assistance. The issues affect PHP, a widely-used open-source programming language that provides a foundation for content management systems like WordPress, which powers a broad array of websites (including those of the Center for Investigative Reporting). […]
Coverage Details
Bias Distribution
- 40% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
