Security researchers and AI models independently discovered two critical vulnerabilities in PHP, the scripting language used by roughly 70% of websites, in mid-August. The flaws can let attackers directly access a site's underlying file system or database, and Amazon Web Services says they are already being widely exploited. The NSA has advised organizations to take unpatched PHP-based sites offline until they can apply fixes, prompting many commercial and government sites to go dark this week.
9to5mac.com
· 2026-10-22
Security researchers disclosed two vulnerabilities affecting the PHP programming language, which is used by an estimated 70 percent of websites including Wikipedia, WordPress and Drupal. The flaws exist in every version of PHP released over roughly the past 20 years, and sites like DeviantArt and 4Chan were temporarily taken offline after disclosure.
theverge.com
· 2026-10-22
OpenAI says researchers using its GPT-5.6 Sol model under the 'Patch the Planet' program discovered critical vulnerabilities in PHP, the language that powers roughly 70% of websites. The PHP Foundation has issued patched versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, though older PHP 8.1 and earlier releases won't be fixed. The coordinated disclosure was moved up a day to Oct. 21 after some details leaked publicly on Oct. 20.
tomshardware.com
· 2026-10-22
UK AI Minister Kanishka Narayan told the BBC that artificial intelligence tools have been used to uncover around 500 previously unknown vulnerabilities across government systems. The disclosure came as organisations worldwide raced to patch a separate critical cyber-security flaw capable of affecting millions of websites.
bbc.co.uk
· 2026-10-22
Energize Lab, maker of the Eiliko companion robot, says it has closed external access to its backend systems, rotated credentials, and disabled a remote interface that allowed robot responses to be altered after a Verge report exposed security flaws. The company has also disabled the robots' long-term memory and custom avatar features, saying it will delete stored conversation records, user profiles and avatar images, and will hire an independent security firm to review its systems before restoring those features.
theverge.com
· 2026-10-22
Amazon Web Services researchers reviewing honeypot logs found that an attacker attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before the flaws were publicly disclosed and patched on Wednesday. The attempt originated from an IP address linked to a commercial anonymization service, and AWS also logged a wave of further exploitation attempts in the hours before the official disclosure at 10 am ET.
wired.com
· 2026-10-22
PHP disclosed two critical vulnerabilities affecting versions from PHP 5 onward and urged operators to patch immediately. In response, government websites in Europe and elsewhere temporarily shut down on Wednesday while administrators applied fixes. Cloudflare CTO Dane Knecht said the company observed early attacks and was updating firewall rules as a temporary stopgap while awaiting the official patch.
developers.slashdot.org
· 2026-10-21
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
cnet.com
· 2026-10-21
The PHP Foundation released emergency updates on Wednesday to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could let attackers remotely take control of affected systems. The flaws affect all PHP installations serving web requests dating back to PHP 5 from 2004, though only PHP 8.2 and newer will receive official patches, with some legacy fixes available through third-party vendors.
wired.com
· 2026-10-21
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
php2shell.com
· 2026-10-21
Researchers found eight intermediate certificates from India's eMudhra with private keys weak enough to be guessed in at most 256 tries, some with as few as 3-8 bits of entropy instead of 384. These certificates chained to roots trusted by major browsers and operating systems, meaning anyone with a key could impersonate any website. Separately, two critical PHP vulnerabilities became public before patches were ready, leaving servers exposed in the interim.
techspot.com
· 2026-10-21
Anthropic published research showing Claude can automatically map which parts of a codebase are reachable and recommend removing or restricting unneeded code paths. Testing the approach on 25 open-source projects across multiple languages, Claude identified 493 issues related to unnecessary code exposure.
anthropic.com
· 2026-10-21
GoKawiil