Millions of hacking attempts as companies, governments rush to patch PHP flaws
OpenAI-assisted researchers found the flaws, and Cloudflare said attack attempts jumped from thousands to millions after the disclosure.
- On Wednesday, OpenAI and partners revealed they used AI to detect critical vulnerabilities in PHP, the programming language powering 70% of websites, coordinating a patch release before public disclosure.
- For 22 years, PHP functioned like a bank without security guards, with flaws previously too tedious to exploit manually; AI tools now identify these weaknesses in two days.
- Last Friday, Chainguard CEO Dan Lorenc unilaterally broke the embargo, potentially allowing attackers to reproduce exploits 14 hours before the patch released, drawing criticism from security researchers.
- Anthropic deputy security chief Jason Clinton warned of an impending "vulnerability tsunami," advising organizations to isolate critical devices and seek board support to patch core network vulnerabilities immediately.
- Complex legacy systems remain difficult to update, as many companies lack visibility to defend against AI-driven attacks, highlighting the urgent need for a paradigm shift in global cybersecurity operations.
132 Articles
132 Articles
'Black October' Alert: Cyber Experts Warn AI-Discovered Flaws Could Trigger Major Outages as Governments Issue Security Alerts
Critical PHP vulnerabilities uncovered with AI assistance have prompted emergency patching, government warnings and temporary website outages, while experts assess the wider cybersecurity risks posed by increasingly powerful tools.
OpenAI researchers have discovered a critical PHP security flaw. We show you which Windows versions are affected by the vulnerability and how to download the patch.
TechXplore
Knowridge Science ReportAI-assisted discovery exposes decade-old PHP flaw that could put millions of websites at risk
Governments and organizations around the world began scrambling on Oct. 21, 2026, to fix a vulnerability in software that runs their websites, a bug that could give hackers access to data and control of websites. The flaw in PHP, the programming language that powers much of today's web, prompted urgent warnings from the U.S. National Security Agency, cybersecurity agencies and software vendors.
The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days
In July 2004, security researcher Stefan Esser sent a warning. A critical flaw in PHP, the programming language that powers 70% of the world’s websites, could allow an attacker to do some seriously nefarious stuff: read passwords, steal databases or even take over entire websites. But Esser’s warning went mostly ignored for decades. In 2020, …
Coverage Details
Bias Distribution
- 51% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
