AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
Researchers used AI to uncover flaws that can let attackers run code on unpatched servers, and PHP said 9.2-rated fixes are now available.
- On Wednesday, PHP developers released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell, rated 9.2 on the CVSS severity scale.
- Security firms Calif and Wiz independently discovered these flaws in August 2026 using OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon models, marking a significant AI-assisted breakthrough after vulnerabilities lay hidden for over a decade.
- PHP powers roughly 70% of websites worldwide, and these vulnerabilities enable unauthenticated remote code execution—a capability Wiz Research calls among the most severe ever discovered in software history.
- Government websites in the Netherlands, Finland, and Canada went offline Wednesday as a precautionary measure while administrators scrambled to apply patches before potential exploitation.
- The European Union Computer Emergency Response Team and National Security Agency urge immediate patching, warning that researchers have detected early attacks and a potential race to exploit the newly disclosed flaws.
774 Articles
774 Articles
Radio France Internationale
The Peninsula QatarWebsites down: what is PHP and how has it raised AI hacking fears?
As AI's fast-advancing capabilities fuel concern over the increased risk of cyberattacks, here are some questions and answers about the situation: What is PHP and how widely used is it? Created in the early 1990s, PHP is a computer programming language that helps run an estimated 70 percent of the world's websites. It is "a backbone of the web", according to security firm Wiz Research, which says it used AI to find vulnerabilities hidden in PHP …
Government agencies and companies worldwide are rushing to shut down websites or temporarily suspend online services after two critical security vulnerabilities were discovered in the PHP programming language, which is used by many websites around the globe.
<p>In Europe and the world, state sites are being massively disabled due to the threat of large-scale cyberattacks Public sites are temporarily disabled due to two critical PHP vulnerabilities. They can allow remote launch of malicious code without authorization.</p>
Global alert over two critical PHP flaws forces government websites offline
Governments and companies in several countries temporarily took websites offline this week over two critical vulnerabilities in PHP, the programming language that powers much of the internet, which allow an attacker to run code remotely on servers without authenticating. PHP’s development team released fixes on Wednesday and urged users to update immediately.
Coverage Details
Bias Distribution
- 41% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
