AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk
The flaws rate 9.2 and could let attackers run code without logging in, prompting emergency patches and temporary shutdowns of some sites.
- On Wednesday, the PHP Foundation released emergency patches for two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, urging website operators to update immediately or isolate affected systems.
- Security firm Calif and Google-owned Wiz discovered these flaws, dubbed "PHP2Shell," in August using AI models GPT-5.6 Sol and Gemini 4 Argon; both vulnerabilities carry a 9.2 CVSS severity rating.
- Following guidance from the National Security Agency and CERT-EU, government agencies in the Netherlands, Finland, and France temporarily took public websites offline Wednesday as a precautionary measure while applying security fixes.
- Web and cloud security firm Cloudflare CTO Dane Knecht warned that "attacks were emerging," and because PHP powers roughly 70% of the web, these flaws present systemic risk to enterprise infrastructure.
- San Francisco-based OpenAI officials state this discovery marks "a new phase, where AI can find security bugs with internet-scale impact," though experts warn AI also enables hackers to reverse-engineer exploits at unprecedented speeds.
809 Articles
809 Articles
Hong Kong watchdog warns of hacking risks from flaws in web programming language
A Hong Kong information security watchdog issued an “extremely high risk” warning on Thursday morning over two critical flaws in a widely used web programming language that could allow hackers to execute code remotely and take control of servers. The warning followed similar alerts from governments and cybersecurity agencies overseas, which urged website operators to install updates to fix the vulnerabilities in the PHP programming language. The…
Radio France Internationale
Websites down: what is PHP and how has it raised AI hacking fears?
As AI's fast-advancing capabilities fuel concern over the increased risk of cyberattacks, here are some questions and answers about the situation: What is PHP and how widely used is it? Created in the early 1990s, PHP is a computer programming language that helps run an estimated 70 percent of the world's websites. It is "a backbone of the web", according to security firm Wiz Research, which says it used AI to find vulnerabilities hidden in PHP …
Coverage Details
Bias Distribution
- 42% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
