Published • loading... • Updated
AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
- On October 21, 2026, PHP released an emergency patch following the online leak of PHP2Shell proof of concept, as Cloudflare confirmed active exploitation of the critical vulnerabilities.
- Two critical RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, impact PHP versions from 5.4 up to 8.5, each carrying a critical 9.2 CVSS v4.0 score.
- Official patches for PHP are only provided for supported versions including 8.2 and newer, while older versions like 8.1, 7, and 5 will not receive updates; current WAF rules offer no protection.
- Aikido is working on releasing pre-patched base images to streamline deployment, but one must immediately apply security updates once published to secure Web applications.
- Security teams should perform post-patch forensics on logs back to June 2026, specifically looking for Web shells, modified files, unauthorized admin users, and anomalous outbound connections.
Insights by Ground AI
206 Articles
206 Articles
European government websites go dark as software flaw sparks security scramble
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.
·Toronto, Canada
Read Full Article
Numerous websites and online services worldwide are currently in danger: The reason for this is a vulnerability in the widespread programming language PHP. The potential danger is therefore extremely high.
·Hamburg, Germany
Read Full ArticleCoverage Details
Total News Sources206
Leaning Left21Leaning Right29Center24Last UpdatedBias Distribution39% Right
Bias Distribution
- 39% of the sources lean Right
39% Right
L 28%
C 33%
R 39%
Factuality
To view factuality data please Upgrade to Premium
