Following last week's discovery of two major PHP vulnerabilities by a team using an OpenAI model, engineers worldwide rushed to patch websites, with some European government sites temporarily going offline during updates. Reuters reports that the PHP Foundation, the nonprofit responsible for coordinating security fixes for the software powering roughly 70% of websites, has only one full-time staff member, Executive Director Elizabeth Barron, supported by about 14 part-time contractors.
cnet.com
· 2026-10-27
Matthew Prince told Reuters that Cloudflare has identified several other severe vulnerabilities in widely used critical software, beyond the recent PHP flaws that knocked government sites, GOG, and other websites offline. He said AI tools are making it far easier for both researchers and attackers to find and exploit such bugs in core internet infrastructure.
techspot.com
· 2026-10-25
A developer released a WordPress plugin that replaces visible CAPTCHAs with a silent proof-of-work challenge, requiring visitors' browsers to solve a small cryptographic puzzle before submitting forms. The plugin claims to work across logins, registrations, comments, WooCommerce checkout and major form builders like Contact Form 7, WPForms and Gravity Forms by recognizing submission signatures rather than relying on per-plugin integrations, and it offers a manual mode to learn custom or unsupported forms.
wordpress.org
· 2026-10-22
Security researchers disclosed two vulnerabilities affecting the PHP programming language, which is used by an estimated 70 percent of websites including Wikipedia, WordPress and Drupal. The flaws exist in every version of PHP released over roughly the past 20 years, and sites like DeviantArt and 4Chan were temporarily taken offline after disclosure.
theverge.com
· 2026-10-22
The UK government is assessing whether its online services are exposed to newly disclosed vulnerabilities in PHP, the programming language running a large share of websites worldwide, including platforms like Wikipedia and WordPress. The National Cyber Security Centre, along with counterparts in the EU and Australia, has urged organisations to apply fixes immediately or take affected systems offline, while Amazon reported attempted attacks on its systems before the public warning was even issued.
bbc.co.uk
· 2026-10-22
The PHP Foundation issued an emergency security patch for two critical vulnerabilities in its widely used web programming language, prompting the Netherlands, Denmark, France and Finland to take some government websites offline as a precaution. Canada's Minister of Artificial Intelligence and Digital Innovation, Evan Solomon, confirmed Canada also took sites down temporarily and urged PHP users to update immediately. The flaws, present in PHP versions released over roughly 20 years, were reportedly discovered using AI tools employed by cybersecurity firms.
engadget.com
· 2026-10-21
Automattic has started cutting staff over the past week, hitting its communications team, social media team, WordPress.com, and its VIP enterprise business, with insiders telling TechCrunch more cuts are expected. The layoffs follow a chaotic period at the company that included a failed board attempt to oust CEO Matt Mullenweg in September, a complete board turnover, and departures of its CFO, interim CFO and Chief Legal Officer.
techcrunch.com
· 2026-10-21
Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
theverge.com
· 2026-10-21
PHP issued an emergency security update fixing two critical vulnerabilities that let attackers run arbitrary code on vulnerable servers, affecting software behind Drupal, Magento, Joomla and WordPress. Researchers at Wiz, who helped discover the bugs along with OpenAI, say every PHP version released in the past decade contains at least one flaw, and Cloudflare and Reuters reported active exploitation and government site outages following disclosure.
krebsonsecurity.com
· 2026-10-21
Researchers disclosed PHP2Shell, a set of memory-safety vulnerabilities in PHP's core, covering two CVEs related to out-of-memory corruption and stale global state persisting across requests. The flaws affect any site running vulnerable PHP versions, even simple applications with secure code, and are not tied to any specific CMS. WordPress, Drupal and Joomla were used only as demonstration targets for unauthenticated remote code execution, and the PHP team has released fixes.
php2shell.com
· 2026-10-21
Wiz Research disclosed multiple critical vulnerabilities in the core PHP engine, grouped under two CVEs with severity up to CVSS 9.2, which could let attackers remotely execute code, disclose memory, steal data or deface sites without authentication. PHP, which underpins roughly 70% of websites including WordPress, Joomla, Drupal and MediaWiki, has been affected since version 5.4, and a patch was released on October 21, 2026 following a coordinated cross-industry disclosure effort.
wiz.io
· 2026-10-21
The UK's National Cyber Security Centre, along with EU and Australian counterparts, has told organisations using PHP to install a critical update released by the PHP Foundation on Wednesday. Two vulnerabilities were identified that could allow unauthenticated remote code execution, potentially letting attackers install malware or disable websites. Officials say affected versions may stretch back as far as PHP 5, released in 2004.
bbc.co.uk
· 2026-10-21
GoKawiil