22-10-2026
Critical vulnerabilities in PHP, a programming language used by more than 70 percent of websites worldwide, have prompted urgent security fixes and precautionary shutdowns of government and other public websites. The flaws, dubbed PHP2Shell, affect PHP versions 5.4 and later and arise from the way the software handles fatal errors, such as running out of memory. Exploitation could let attackers run code on affected websites, alter them, or access personal information and credentials stored in server memory. Both vulnerabilities received a critical severity score of 9.2 out of 10.
Researchers at cybersecurity companies Calif and Wiz discovered the flaws independently with the help of artificial intelligence. Calif, working with OpenAI, reported one in August; Wiz reported the other later that month. The issues had been present in PHP’s code for more than a decade. Although researchers coordinated disclosure with PHP’s developers and others so fixes could be prepared, Amazon security chief CJ Moses said his team detected an attempted exploit on October 17, before the public disclosure. It remains unclear how the attacker learned of the vulnerabilities.
PHP developers released fixes and urged users to update immediately. Experts nevertheless warned of potential attacks as operators raced to patch systems. Government and public-facing services in the Netherlands, Finland, France and Belgium were taken offline or placed into preventive maintenance. South Korea raised its cybersecurity alert level and issued guidance to thousands of companies and critical infrastructure operators. Wikipedia and the Internet Archive also took some systems offline temporarily.
The article highlights the internet-wide implications of a flaw in foundational software, while noting that updated sites are protected. University of Melbourne lecturer Andrew Cullen also cautions that AI can help find and fix vulnerabilities, but can assist attackers in discovering or creating exploitable bugs as well.
Entities: PHP, PHP2Shell, Andrew Cullen, University of Melbourne, Calif • Tone: urgent • Sentiment: negative • Intent: inform
22-10-2026
Authorities in Europe, Asia and elsewhere have taken some government websites temporarily offline after researchers identified two critical vulnerabilities in PHP, a programming language used by a large share of websites. The US National Security Agency issued a rare public warning, advising organizations to update affected systems immediately or take websites offline until they can be patched. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic reported taking websites offline or applying security measures. Japan’s Prime Minister Sanae Takaichi also warned about the risk on social media.
The vulnerabilities, collectively dubbed PHP2Shell, were discovered with assistance from artificial intelligence tools. Researchers at Calif, working with OpenAI, reported one flaw on August 11; Wiz, an Alphabet-owned security firm, reported the other on August 24. Wiz described the findings as among the most severe vulnerabilities found in PHP and said the underlying flaws had existed for decades. Demonstrating how to exploit them required a sequence of steps that had been difficult for human researchers to accomplish.
The flaws involve unauthorized access to portions of computer memory. An attacker could use them to run commands remotely on a server using vulnerable PHP code, without a password or legitimate account. The nonprofit PHP Foundation called the vulnerabilities among the most severe it had encountered and urged website administrators to update their code immediately.
The Foundation also warned that AI could make security weaknesses easier to find, benefiting both defenders and attackers. It called for technology companies to coordinate their response to reduce the risk of major disruption to online services, noting that reports of software bugs are likely to increase as tools find them more quickly.
Entities: PHP, PHP2Shell, United States National Security Agency (NSA), PHP Foundation, Umar Farooq • Tone: urgent • Sentiment: negative • Intent: inform
22-10-2026
A serious set of vulnerabilities in PHP, a programming language used to power a large share of websites, triggered a global cyber-security alert after researchers used advanced artificial-intelligence tools to uncover flaws that had gone undetected for years. The weaknesses could let attackers take control of affected web servers without authentication and steal sensitive information. Experts warned that AI could make exploitation faster and that millions of websites may be affected.
The discovery prompted organisations and governments to take precautionary action. Wikimedia, public bodies in Finland and Scotland, the BBC, and the Netherlands’ cyber-security agency were among those that temporarily took some websites or systems offline. Experts said smaller organisations with limited security resources could be particularly exposed, and predicted further attempts to exploit the flaws as technical details become public.
PHP developers released patches, urging users to update immediately. The US National Security Agency advised organisations that could not patch at once to take affected systems offline, while the UK, EU, and Australian cyber-security authorities issued similar warnings. Japan’s prime minister also urged website operators to check whether their sites used PHP and consider suspending them if a prompt fix was not possible.
Researchers said AI tools helped analyse complex code and identify long-standing bugs more quickly, but the episode also illustrates how AI could help attackers create offensive tools. Website operators are urged to install the latest PHP version, monitor vendor updates, and check for signs of compromise. Individual users should heed security advice from affected services and be cautious of phishing messages exploiting the incident.
Entities: PHP (PHP: Hypertext Preprocessor), Artificial intelligence (AI), Wiz, OpenAI, Paul Spain • Tone: urgent • Sentiment: negative • Intent: inform
22-10-2026
Organisations worldwide are rushing to update systems after critical vulnerabilities were discovered in PHP, a long-established programming language used to run websites. Researchers warned that the flaws, dubbed “php2shell,” could let attackers remotely execute code on affected servers if systems are not patched. No successful attacks had been reported at the time of publication, but experts cautioned that the consequences could take months to emerge.
The UK government took some services offline as a precaution while applying security updates and mitigations. Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partially unavailable, largely because of protective measures. The government said no major public-facing critical services were affected, and that teams were working to identify and fix potential exposures. The National Cyber Security Centre described the event as unprecedented but said it had no indication of successful breaches and was receiving confirmation that its guidance was being acted on.
The disruption also affected businesses and public services. A garage owner in Chepstow said he could conduct MOT tests but could not process their paperwork or print certificates online, forcing him to use paper records and delaying customers. Some organisations, including a Dutch cyber-security agency, Finnish government services and parts of Wikipedia, restored service after temporary outages; France’s Orange suspended access to some services while applying fixes.
PHP underpins a substantial share of websites and is used by platforms including Wikipedia, WordPress and online shops. Security researchers at Wiz helped uncover the vulnerabilities, and the PHP Foundation warned that affected versions could expose servers to unauthenticated remote code execution. Cloudflare reported a sharp rise in attempted exploitation after public disclosure, while Amazon also observed attempts but said its websites remained operational. Experts stressed that attackers now exploit vulnerabilities within hours or days, making rapid patching and careful workload management essential.
Entities: PHP, php2shell vulnerability, National Cyber Security Centre (NCSC), UK government, Baroness Lloyd of Effra • Tone: analytical • Sentiment: negative • Intent: inform
22-10-2026
Critical vulnerabilities in PHP, an open-source programming language used by many websites and web applications, have triggered urgent warnings from governments and a coordinated response from technology and cybersecurity companies. The flaws, collectively called “PHP2Shell,” could let attackers remotely execute malicious code on affected servers and potentially access sensitive data, file systems, and databases. Because PHP is widely used, the vulnerabilities may affect organizations across industries and countries, although not every PHP-based website is necessarily vulnerable.
The U.S. National Security Agency urged organizations using PHP to prepare and apply security updates, advising them to take affected systems offline if they cannot update them promptly. The FBI and cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada, and the European Union also issued warnings.
Amazon said its MadPot threat detection system identified attempts to exploit the flaws before their public disclosure. The company said it did not know how the attackers learned of the vulnerabilities in advance. Google reported that its cybersecurity unit, Wiz, used AI models to help investigate the flaws, while Gemini assisted with assessing them, testing possible attacks, and verifying patches. OpenAI said researchers working with its AI models also helped uncover vulnerabilities and that it had spent two months coordinating with software maintainers, researchers, and security providers to prepare fixes and protective measures.
Cloudflare said it had deployed web application firewall protections to block malicious requests targeting affected systems. The PHP development team has released security fixes, and authorities are urging website operators to identify affected versions and update quickly. The incident illustrates the broad risks posed by vulnerabilities in widely used software, as well as AI’s growing role in both discovering security weaknesses and potentially enabling their exploitation.
Entities: PHP, PHP2Shell, National Security Agency (NSA), Federal Bureau of Investigation (FBI), Amazon • Tone: analytical • Sentiment: negative • Intent: inform
22-10-2026
Two critical vulnerabilities in PHP, a programming language used by roughly seven in 10 websites, prompted governments and organisations across Europe to take websites and online services offline while they applied security updates. The flaws, present in PHP for more than a decade and affecting versions released over the past decade, could allow attackers to run code remotely without logging in. Patched releases are available, and CERT-EU warned that older versions should be considered exposed unless a vendor has supplied a backported fix.
AI-assisted security research helped turn a previously suspected weakness into a working attack. Researchers from Calif, OpenAI and Wiz used advanced models and tools to identify and demonstrate attack methods. The PHP Foundation said its developers had noticed signs of the issue in 2024, but work on a fix stalled amid uncertainty and limited resources—a delay it described as a “structural failure.” After vulnerability identifiers and proof-of-concept material leaked online, PHP moved its release forward. Security experts warned that public technical details could make it easier for attackers to act quickly.
The article stresses that taking a site offline does not itself mean it was hacked. The PHP Foundation said it found no functional exploit in the circulating proof-of-concept code at the time of release, although Cloudflare later reported attack traffic aimed at customers and CERT-EU warned that probing was more likely. Large organisations may patch quickly, but smaller businesses and user-run sites could remain vulnerable for longer. Potential consequences include hijacked sites, malware distribution, spam and stolen personal information being used in phishing. Third-party services can also leave an organisation exposed even after it patches its own systems. The article concludes that updating PHP is urgent, but effective cybersecurity requires multiple layers of defence.
Entities: PHP, PHP Foundation, OpenAI, Google, Wiz Research • Tone: urgent • Sentiment: negative • Intent: inform
22-10-2026
Canadian officials say there is currently no indication that federal government systems or information were compromised after a serious vulnerability was discovered in PHP, a programming language used by roughly 70 per cent of websites worldwide. The vulnerability was identified on October 21. Under certain conditions, it could allow an attacker to run unauthorized commands on affected systems without authentication. Government officials said security updates were being applied and that some websites could remain unavailable or experience service disruptions while systems were secured and access restored.
Artificial Intelligence Minister Evan Solomon told a Senate committee that the government was taking the issue very seriously. Several federal websites were proactively taken offline as a precaution, following guidance from the Canadian Centre for Cyber Security. Among the affected sites were Statistics Canada and the Canadian Intellectual Property Office. Statistics Canada’s website returned around noon on Thursday after being offline for several hours while cyber security officials and government teams worked on updates. The Intellectual Property Office’s website remained offline at the time of reporting, displaying a notice that urgent maintenance was underway.
The disruption was part of a wider response: websites and organizations around the world also went offline as a precaution, amid reports of millions of attempted hacks. Solomon described the vulnerability as a global issue and said other governments and organizations were taking protective measures. The article reports precautionary shutdowns and ongoing remediation, while emphasizing that officials had not found evidence of a breach of federal systems or information.
Entities: Evan Solomon, Ariel Rabinovitch, Government of Canada, Statistics Canada, Canadian Intellectual Property Office • Tone: neutral • Sentiment: neutral • Intent: inform
22-10-2026
Cloudflare recorded a rapid increase in attempts to exploit newly disclosed vulnerabilities in PHP, according to CEO Matthew Prince. The company saw thousands of attempts in the 10 hours before the vulnerabilities were publicly announced on Oct 21, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the time Prince posted about the activity. PHP developers issued urgent fixes for flaws that had remained undiscovered for years and urged users to update immediately. The vulnerabilities were uncovered with the help of AI. Their disclosure prompted website operators and governments to take emergency steps to protect systems. Some government websites in Europe and elsewhere went offline. In Japan, Mitsubishi UFJ Financial Group temporarily suspended some internet services, while the Finance Ministry temporarily suspended some website content and services as security measures were implemented. Prime Minister Sanae Takaichi urged website owners to check whether their sites use PHP and prepare to apply the fixes. The article describes the immediate global response to the disclosure and the sharp rise in observed exploitation attempts, but does not specify the technical details of the flaws or report confirmed damage from the attacks.
Entities: Cloudflare, Matthew Prince, PHP, PHP vulnerabilities, AI-assisted vulnerability discovery • Tone: analytical • Sentiment: negative • Intent: inform
