The UK government is assessing whether its online services are exposed to newly disclosed vulnerabilities in PHP, the programming language running a large share of websites worldwide, including platforms like Wikipedia and WordPress. The National Cyber Security Centre, along with counterparts in the EU and Australia, has urged organisations to apply fixes immediately or take affected systems offline, while Amazon reported attempted attacks on its systems before the public warning was even issued.
bbc.co.uk
· 2026-10-22
Researchers using artificial intelligence discovered long-standing vulnerabilities in PHP, the programming language that powers a large share of the world's websites. The flaws, undetected for more than ten years, prompted governments and cyber-security agencies to issue an emergency fix and advise some website operators to take systems offline until patched. Cyber-security firm Wiz and OpenAI, whose AI tools helped surface the issues, both described the discovery as among the most significant security findings in recent memory.
bbc.co.uk
· 2026-10-22
Amazon Web Services researchers reviewing honeypot logs found that an attacker attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before the flaws were publicly disclosed and patched on Wednesday. The attempt originated from an IP address linked to a commercial anonymization service, and AWS also logged a wave of further exploitation attempts in the hours before the official disclosure at 10 am ET.
wired.com
· 2026-10-22
Security researchers identified two critical vulnerabilities in PHP, the widely used web programming language, that could let attackers remotely execute malicious code on servers. Google, OpenAI and Amazon have been involved in efforts to detect exploitation attempts and help secure affected systems, while the US NSA and FBI issued warnings urging organizations to patch or take vulnerable systems offline.
cnbc.com
· 2026-10-22
A security blogger argues that a newly disclosed PHP vulnerability, widely discussed online for roughly ten hours, lacks a functioning proof-of-concept despite thousands of 'PoC' exploit scripts appearing on GitHub. The author says none of these scripts actually work against a standard PHP server when tested directly, and contrasts the situation with past critical bugs like Log4Shell, Heartbleed and Shellshock, which were exploited within hours of disclosure.
eliastaylor.com
· 2026-10-21
Security researchers have disclosed two PHP flaws, CVE-2026-109618 and CVE-2026-109619, affecting PHP web runtimes, along with a suggested AWS WAF rule named 'PHP2Shell' to help block exploitation attempts. The rule targets POST requests that combine PHPSESSID cookie or body values with the PHP_SESSION_UPLOAD_PROGRESS parameter, a pattern associated with session-based remote code execution attacks against PHP applications.
aws.amazon.com
· 2026-10-21
The PHP Foundation issued an emergency security patch for two critical vulnerabilities in its widely used web programming language, prompting the Netherlands, Denmark, France and Finland to take some government websites offline as a precaution. Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, confirmed Canada also took sites down temporarily and urged PHP users to update immediately. The flaws, present in PHP versions released over roughly 20 years, were reportedly discovered using AI tools employed by cybersecurity firms.
engadget.com
· 2026-10-21
Security firm Calif uncovered two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, that allow unauthenticated remote code execution via memory corruption and stale global state issues. WatchTowr researchers confirmed they could reproduce both flaws after a proof-of-concept tool called PHP2Shell leaked ahead of a planned coordinated disclosure, and PHP's maintainers have released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
darkreading.com
· 2026-10-21
A wave of cybersecurity incidents struck simultaneously: AI-discovered PHP vulnerabilities took government websites offline and prompted an NSA advisory to patch or disconnect affected systems. Node.js patched four high-severity bugs including a remote code execution flaw and TLS bypass issues, while LiteLLM confirmed its packages on PyPI, Docker Hub and GHCR were compromised with malware that stole credentials and enabled remote access. Separately, certificate authority eMudhra had private keys compromised, raising concerns about fraudulent website certificates.
techcrunch.com
· 2026-10-21
Cybersecurity firm Calif used OpenAI's GPT-5.6 Sol model to discover two severe security vulnerabilities in PHP, the code powering roughly 70 percent of websites, reporting them to the PHP Foundation on August 11. Google-owned Wiz independently confirmed the flaws on August 24, calling them among the most severe in software history, and a patch was released Wednesday after sites including Wikipedia and Steam temporarily went offline.
futurism.com
· 2026-10-21
The NSA issued an alert on two severe vulnerabilities in PHP, the server-side language that underpins roughly 70% of websites, including those running WordPress. The flaws, present since PHP version 5 in 2004, let attackers access a server's file system or database, and the PHP Foundation has already released patches, recommending an update to PHP 8.5.12. The bugs were uncovered through AI-driven security research: one by Calif using OpenAI's GPT-5.6 Sol under its 'Patch the Planet' program, and others by Google-owned Wiz using its Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol.
techcrunch.com
· 2026-10-21
PHP disclosed two critical vulnerabilities affecting versions from PHP 5 onward and urged operators to patch immediately. In response, government websites in Europe and elsewhere temporarily shut down on Wednesday while administrators applied fixes. Cloudflare CTO Dane Knecht said the company observed early attacks and was updating firewall rules as a temporary stopgap while awaiting the official patch.
developers.slashdot.org
· 2026-10-21
GoKawiil