BBC technology editor Zoe Kleinman reports that long-standing vulnerabilities in the widely used PHP programming language were uncovered with AI assistance, prompting a global rush to patch affected websites. Some sites were taken offline as a precaution after news of the flaws leaked earlier than planned, though no confirmed successful exploitation has been reported, despite millions of attack attempts logged by firms like Cloudflare and Palo Alto Networks.
tech.slashdot.org
· 2026-10-22
Developers of the widely used PHP programming language disclosed critical security vulnerabilities this week, prompting websites worldwide to go offline as organisations rushed to patch systems. The UK government confirmed 32 services were unavailable and four partially unavailable as a precaution, with ministers saying no major public-facing critical services were affected and no breaches have been confirmed.
bbc.co.uk
· 2026-10-22
Quest Diagnostics has reported that an unauthorized party gained access to patient records held by the company. Details on the number of patients affected, the data exposed, and how the breach occurred have not been fully disclosed.
gizmodo.com
· 2026-10-22
Security researchers report that attackers are using AI tools to find and exploit vulnerabilities in PHP, the programming language underlying a large share of the world's websites. Technology companies and developers are now working to patch affected systems and shore up defenses against these automated attacks.
wsj.com
· 2026-10-22
Amazon reported it detected hackers attempting to exploit two vulnerabilities in the PHP programming language four days before the flaws were publicly disclosed, and said exploitation is now widespread. The US NSA and UK authorities separately warned organizations running PHP to patch immediately or take systems offline, and PHP's maintainers have released fixes. The bugs reportedly went undetected for more than a decade and were found with help from OpenAI and Google AI models.
arstechnica.com
· 2026-10-22
Amazon's Threat Intelligence team says it detected an attempt to exploit two critical PHP vulnerabilities on October 17th, using a honeypot monitoring system, days before an official patch was released this week. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers remotely execute malicious code on PHP-based systems including WordPress sites. The PHP Foundation's executive director Elizabeth Barron says there's no known successful remote code execution so far, but urges all affected systems be updated immediately.
theverge.com
· 2026-10-22
Researchers at AI firm Calif and Google's Wiz discovered a set of vulnerabilities, dubbed PHP2Shell, affecting all PHP installations serving web requests, using AI tools including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. The flaws allow unauthenticated attackers to remotely execute code on PHP servers, prompting the NSA to urge organizations to patch immediately or take servers offline, and causing some European government websites to go dark. A proof-of-concept video accidentally posted by Calif leaked details early, forcing the PHP Foundation to fast-track patches originally planned for release a day later.
cnbc.com
· 2026-10-22
Security researchers and AI models independently discovered two critical vulnerabilities in PHP, the scripting language used by roughly 70% of websites, in mid-August. The flaws can let attackers directly access a site's underlying file system or database, and Amazon Web Services says they are already being widely exploited. The NSA has advised organizations to take unpatched PHP-based sites offline until they can apply fixes, prompting many commercial and government sites to go dark this week.
9to5mac.com
· 2026-10-22
Security researchers disclosed two vulnerabilities affecting the PHP programming language, which is used by an estimated 70 percent of websites including Wikipedia, WordPress and Drupal. The flaws exist in every version of PHP released over roughly the past 20 years, and sites like DeviantArt and 4Chan were temporarily taken offline after disclosure.
theverge.com
· 2026-10-22
OpenAI says researchers using its GPT-5.6 Sol model under the 'Patch the Planet' program discovered critical vulnerabilities in PHP, the language that powers roughly 70% of websites. The PHP Foundation has issued patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, though older PHP 8.1 and earlier releases won't be fixed. The coordinated disclosure was moved up a day to Oct. 21 after some details leaked publicly on Oct. 20.
tomshardware.com
· 2026-10-22
Researchers identified long-dormant security flaws in PHP, the programming language underpinning millions of websites, prompting operators to take sites offline as a precaution even though no attack has yet occurred. The bugs were difficult to exploit manually, but AI tools reportedly helped researchers uncover them faster, and the PHP Foundation has issued a fix.
bbc.co.uk
· 2026-10-22
A Hacker News user has publicly apologized for prematurely disclosing details of two upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before the coordinated disclosure embargo lifted. The poster says they were told by a contact that no embargo existed and only meant to warn fellow PHP users who build from source about the urgency of upcoming patches.
news.ycombinator.com
· 2026-10-22
GoKawiil