AI Uncovers Critical PHP Vulnerability Affecting 70% of Websites as Hackers Exploit Flaw
69 Sources
[1]
Hackers got a four-day head start on epic PHP2Shell vulnerability
Hackers were already probing the bug before defenders were told it existed. Amazon has warned that vulnerabilities in a programming language that underpins much of the internet, discovered using AI tools, are being "broadly exploited" as governments and companies rush to secure their systems. The
[2]
Will AI expose the rickety infrastructure of the internet?
A startling announcement went out earlier this week: Due to recently discovered vulnerabilities in the open source programming language PHP, website owners had to immediately patch their sites -- or if they couldn't update right away, they should take the sites down to be safe. On this week's
[3]
The PHP Meltdown Shows How AI Makes Bugs More Exploitable
Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here. As security teams and web admins scrambled this week to patch newly public PHP bugs,
[4]
Global race to update computers as AI discovers most disruptive hack yet | New Scientist
More than two thirds of the world's websites are vulnerable to a hack that was first theorised in 2024, which AI has now made very real Cybersecurity experts around the globe are racing to update systems and prevent the most disruptive AI-enabled hack yet discovered. A flaw uncovered in
[5]
OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites -- AI-assisted researchers turned a two-year-old bug that stumped human developers into working exploits in two weeks
OpenAI says defenders must proactively strengthen defenses before bad actors begin to exploit AI's extreme capabilities. OpenAI announced in a press release on Oct. 21 that researchers working under its "Patch the Planet" cybersecurity initiative used its AI model GPT-5.6 Sol to uncover critical
[6]
PHP is in the foundation of 70% of websites - here's what it is and why a flaw in the software is a major hacking threat
Governments and organizations around the world began scrambling on Oct. 21, 2026, to fix a vulnerability in software that runs their websites, a bug that could give hackers access to data and control of websites. The flaw in PHP, the programming language that powers much of today's web, prompted
[7]
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg PHP developers have accused software supply chain security shop Chainguard of effectively revealing critical bugs in the open-source scripting language ahead of a planned
[8]
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator. TrendAI, which analyzed three exposed server environments used by threat
[9]
AI-discovered bugs may soon trigger fresh disruptions, cyber experts say
WASHINGTON, Oct 23 (Reuters) - Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to trigger more disruption along the lines of the outages that percolated across global government websites this week, according to seven cybersecurity
[10]
NSA warns on 'critical' cyber vulnerabilities detected using AI
Researchers used OpenAI and Google models to find severe faults in software used on majority of websites around the world The US National Security Agency on Wednesday warned vulnerabilities in a programming language that underpins the internet, discovered using AI tools, had left websites around
[11]
AI's 'Black October': Critical PHP flaws set off global security scramble
* Cybersecurity teams are racing to patch security flaws in the PHP programming language, which were discovered using advanced AI models. * Experts believe the PHP security flaws serve as the latest example of what's to come, and some have dubbed the moment "Black October." * Former CISA Director
[12]
AI Is Finding a Flood of Bugs, and Silicon Valley Is Rushing to Fix Them
On Oct. 21, Fouad Matin, who leads OpenAI's cyber-preparedness and safety efforts, had planned to spend the evening with friends to celebrate his birthday. Instead, he was running on about two hours of sleep as he juggled efforts to patch two critical security vulnerabilities that had been
[13]
AI will keep uncovering critical software flaws for years, says Cloudflare CEO
Serving tech enthusiasts for over 25 years. TechSpot means tech analysis and advice you can trust. Big quote: Cloudflare CEO Matthew Prince says the PHP flaws that forced websites offline last week are only the beginning. His company already knows of other severe vulnerabilities in critical
[14]
How did AI discover the internet's massive cyber-security risk?
Governments and cyber-security agencies around the world are scrambling to contain a massive flaw in internet technology, after AI discovered issues that could be exploited by hackers. Developers of the PHP platform - which powers more than 70% of websites, including Wikipedia and digital shopping
[15]
The AI-Hacking Apocalypse Began Last Night
Websites across the internet are going dark to protect themselves against a newly discovered vulnerability. The internet could be on the verge of a total meltdown. Yesterday, someone posted to a public forum that two major security flaws had been found in a programming language that undergirds the
[16]
'I no longer think we're going to be able to just patch all the bugs'
Speaking at Stanford, the OpenAI chief said most leaders have "somewhat moved on" since the Mythos scare. He also said OpenAI may need to rethink how fast it moves. Sam Altman says patching software flaws one by one will no longer keep up with AI-driven attacks. The OpenAI chief executive spoke to
[17]
OpenAI Wants to 'Patch the Planet' (With Its Own AI)
Modern AI models have prodigious coding capabilities -- whether that poses a greater advantage for legitimate cyberdefenders or for malicious hackers is an open question. Either way, AI companies are thriving. The cybersecurity sector has been in crisis mode in recent months as the spread of new
[18]
Websites scramble to fix software flaw that could put much of internet at risk
AI-assisted research uncovered a critical flaw in software used by as much as 70 percent of websites, raising fears that hackers could rapidly exploit it. A programming language used in as much as 70 percent of websites on the internet has a critical security issue that could allow attackers to
[19]
AI Is Changing Everything About Hacking. No One Knows What Happens Next
'Black October:' The PHP vulnerabilities and a series of other hacks and bugs have cybersecurity experts freaking out and unsure what happens next. For much of the last month, many of the cybersecurity experts I talk to and follow have been posting like they are very scared. Many have been warning
[20]
A.I. Discovered a Critical Security Flaw Underpinning Websites
Security researchers using OpenAI's advanced artificial intelligence models unearthed major bugs in a piece of software used widely across the internet, setting off fears around the world about significant disruptions for consumers and businesses. The Trump administration and some governments in
[21]
Hackers breached 25 servers, including U.S. government-linked systems -- and AI tools may have helped
Researchers found hackers' tools included Claude Code, aiscan, DeepSeek and Kimi. Hackers have reportedly broken into 25 servers across four countries, including systems connected to a U.S. government-affiliated organization. Security researchers also discovered evidence that AI tools may have
[22]
PHP2Shell: AI found two critical flaws in 70% of websites
PHP shipped emergency patches for two critical PHP2Shell flaws that allow unauthenticated code execution. The twist: researchers found them with OpenAI and Google AI models, days before the fix was due. PHP shipped emergency security updates on Wednesday. They fix two critical flaws that let an
[23]
'Black October': cybersecurity experts sound the alarm over new era of AI-enabled hacking
After the discovery of a severe bug in the PHP programming language, executives warned of a coming 'vulnerability tsunami' Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more
[24]
OpenAI helped find the PHP flaws now shaking the internet
OpenAI says its AI models helped uncover the critical PHP security flaws that have websites across the internet scrambling. In a blog post on Wednesday, the company said it had spent the past two months leading a coalition of PHP maintainers, security researchers, and security companies to deal
[25]
AI uncovers massive flaw in web's foundational code
Why it matters: The bugs, which researchers found partly with an OpenAI model, proves AI can uncover critical flaws humans missed for decades -- raising the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed. What's happening: There are two
[26]
AI cyberattacks escalating due to a 20-year-old flaw
A decades-old PHP vulnerability forced major websites offline and exposed the growing threat of AI-powered cyberattacks Websites around the world went dark last week because of a flaw in code most people never think about. It sat inside PHP, software that runs an estimated 70% of all websites,
[27]
AI-assisted discovery exposes decade-old PHP flaw that could put millions of websites at risk
Governments and organizations around the world began scrambling on Oct. 21, 2026, to fix a vulnerability in software that runs their websites, a bug that could give hackers access to data and control of websites. The flaw in PHP, the programming language that powers much of today's web, prompted
[28]
How an OpenAI model exposed a flaw in 70% of the internet's websites | Fortune
A researcher at Calif, a security research firm, found the flaw in August 2026 using an advanced artificial intelligence model from OpenAI. The firm alerted the nonprofit that manages PHP. However, word of the flaw leaked before the PHP organization released patches for its software, and according
[29]
The AI-Discovered Bug That Could Have Become a Cybersecurity Disaster
Twice a week · Essential insights into the unfolding AI revolution. SIGN UP Yes, I agree to receive promotions and news from Time. Please agree to receive promotions to sign up. Something went wrong. Try again. Thank you for signing up! 00:001.0x05:42 Narrated by TIME AI. In early August,
[30]
AI helped uncover a hidden PHP flaw. Now websites worldwide are facing millions of hacking attempts.
A critical PHP vulnerability has websites worldwide racing to install security patches. PHP is the programming language behind roughly 70% of websites, and it just ran into a serious problem. Security researchers used AI to uncover a critical flaw called PHP2Shell, which could let attackers take
[31]
Frontier OpenAI Model Exposes Stunning Exploit That Leaves Millions of Web Servers Open to Attack
Security researchers using an OpenAI model have uncovered two stunning security flaws in PHP, the software that underpins nearly 70 percent of all websites on the internet. The flaws are so catastrophic that all websites using PHP -- all untold millions of them -- are advised to immediately take
[32]
Who Found the PHP Bug That Made Governments Unplug Their Websites? ChatGPT, Of Course
OpenAI says its models found PHP2Shell and led a two-month coalition to fix it. It's the same AI that broke into Hugging Face and an Australian government portal this year. In brief * OpenAI President Greg Brockman said the company led a two-month coalition to fix PHP2Shell, found with its models
[33]
'I no longer think we're going to be able to patch all bugs' says AI Pandora's box opener Sam Altman: 'We're going to have to completely switch the defense model'
If you've watched as many Sam Altman interviews as I have, you'll know he's not shy when it comes to recounting a previously held opinion. Speaking at the Stanford Graduate School of Business last week, the OpenAI CEO spoke about AI safety, particularly in regards to cybersecurity. "The
[34]
'Tech debt coming due': AI-found flaw signals chaos ahead
Washington (United States) (AFP) - Companies and government agencies rushed this week to patch two critical flaws in PHP, the programming language that runs a large share of the world's websites. The vulnerability to potential hackers was found by using a powerful model from OpenAI in one of the
[35]
PHP flaw: Why European websites went dark and what it means for you
AI models uncovered what OpenAI calls "one of the most impactful" security bugs in recent memory, hidden in PHP for more than a decade. From a Pokémon sleep tracker to the Dutch parliament, websites went dark worldwide to stay ahead of hackers. Artificial intelligence has exposed two critical
[36]
What to know about the PHP bug affecting 70% of the world's websites
Cybersecurity researchers used an advanced OpenAI artificial intelligence model to identify a longstanding internet vulnerability before hackers could exploit it. That security weakness affects a programming language called PHP, short for "Personal Home Page," which powers up to 70% of the world's
[37]
Prepare for more website shutdowns in the age of AI - but human inaction is the real culprit | Chris Stokel-Walker
I've been banging the drum about these vulnerabilities for years. It will take more than a handful of exhausted developers to keep us safe Parts of the internet are going dark. In the Netherlands, government websites, including its digital ID login service, have become unavailable. Finland has
[38]
AI helps uncover critical PHP flaw threatening 70pc of internet
These flaws rank among the 'most severe vulnerabilities' arguably discovered in software history, Wiz said. Several websites, from governments and other critical services, to businesses, were taken down yesterday (21 October), to fix a critical security flaw discovered using frontier AI
[39]
Internet on Alert as AI Uncovers Critical Flaws in PHP Used by 70% of Websites
October is revealing cybersecurity chaos, for real. In 24 hours, three major security incidents emerged: eMudhra's compromised certificate private keys, the State Bank of India's customer data breach, and AI-assisted discovery of two critical vulnerabilities in PHP, the programming language used by
[40]
AI-discovered PHP flaws trigger global rush to patch websites
CISA told organizations to take unpatched PHP systems offline as some Wikipedia and 4chan services went down The PHP project released patches on Wednesday for two critical vulnerabilities that can allow unauthenticated remote code execution, sending organizations scrambling to update their systems
[41]
Websites down: What is PHP and how has it raised AI hacking fears?
Artificial intelligence has found critical security flaws in a major programming language called PHP, with many websites taken offline Thursday as organizations worldwide scramble to fend off would-be hackers. As AI's fast-advancing capabilities fuel concern over the increased risk of
[42]
AI helped discover the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack | Fortune
Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take
[43]
This Historic Cybersecurity Flaw Put 70 Percent of Websites at Risk. Patch Yours Today If You Haven't Yet
The critical vulnerability lurks in PHP, a language that underpins sites like Wordpress. The fix is already available. The exposure of a decade-old security flaw that powers 70 percent of global websites sent nations, brands, and cybersecurity experts scrambling this week. Websites went dark,
[44]
The Internet Is Currently On Fire, But How Does That Affect You?
Multiple vulnerabilities have suddenly been reported online, so let's figure out how we got here Over the past 48 hours, multiple security flaws and vulnerabilities have been reported online. While PHP2Shell is still the primary vulnerability that's got everyone scared, it's not the only critical
[45]
Some Websites Go Dark as Operators Address an AI-Detected Flaw in a Web Programming Language
The FBI's cyber division warned Wednesday about the discovery of two "critical vulnerabilities" in PHP, a widely used programming language that powers many websites and web applications The FBI and the National Security Agency warned Wednesday about the discovery of two "critical vulnerabilities"
[46]
NSA warns organizations to patch security flaws identified by AI
The National Security Agency (NSA) warned organizations Wednesday to immediately patch a pair of security flaws or take their systems offline, after artificial intelligence discovered vulnerabilities in a key programming language. "Effective Immediately, all organizations using PHP for their
[47]
PHP releases patches for two critical remote code flaws found with AI
Wiz said every PHP version released in the past decade is affected by at least one flaw, and that PHP powers 70% of websites PHP released security updates on Wednesday that fix two critical vulnerabilities capable of allowing unauthenticated remote code execution, flaws that researchers found with
[48]
Some websites go dark as operators address an AI-detected flaw in a web programming language
An AI-assisted discovery of vulnerabilities in a widely used programming language led governments and other organizations in Europe and the U.S. to take their websites offline temporarily Wednesday as they scrambled to make security updates. The FBI's cyber division warned the vulnerabilities
[49]
AI vulnerabilities: 'Tech debt coming due': AI-found flaw signals chaos ahead
Companies and government agencies rushed this week to patch two critical flaws in PHP, the programming language that runs a large share of the world's websites. The vulnerability to potential hackers was found by using a powerful model from OpenAI in one of the most high-profile demonstration of
[50]
When Cybersecurity Takes a Website Offline: How AI Can Detect PHP Vulnerabilities: By Quadri Owolabi
Artificial intelligence is changing how organisations identify software vulnerabilities and respond to cyber threats. But without effective governance, AI can introduce new security risks even as it attempts to prevent them. Introduction: Website availability is now a cybersecurity priority When
[51]
Critical Flaw Found By AI Puts 70% Of World's Websites At Risk
A critical vulnerability in PHP, an open-source programming language that's used in around 70% of all websites, forced prominent sites to go dark Wednesday as operators scrambled to patch their systems. The security issue was first discovered two months ago by Calif, an AI security firm. The
[52]
AI-powered cyberattacks on websites surge
Cyberattacks targeting companies through publicly accessible websites and apps have more than doubled from last year, according to Macnica, a major Japanese cybersecurity company. There have been 216 cases involving confirmed or suspected data breaches reported so far this year, or 2.6 times the
[53]
A Sharp Spike in AI Cyberattacks is Expected Within 18 Months
The internet, a cornerstone of modern life, faces an unprecedented challenge as AI-driven cyberattacks grow in scale and sophistication. Unlike traditional hacking methods, these attacks use artificial intelligence to identify and exploit vulnerabilities with alarming speed and precision. Wes Roth
[54]
Government Websites Go Dark as AI-Discovered PHP Flaws Send Cybersecurity Teams Scrambling -- FBI Urges Im
Critical vulnerabilities in the PHP programming language prompted government websites across Europe to temporarily go offline Wednesday as organizations scrambled to apply emergency security patches. This prompted the Federal Bureau of Investigation's Cyber Division to call for immediate security
[55]
Tech Companies Battle Infestation of AI-Discovered Bugs | PYMNTS.com
Tech companies are reportedly spending more time and resources dealing with bugs uncovered by artificial intelligence (AI). That's according to a report Wednesday (Oct. 28) by The New York Times, which says technologists are becoming overwhelmed at the volume of flaws. In May, OpenAI began
[56]
AI is finding software flaws faster, and so are hackers: Inside the PHP scramble
Governments and companies across Europe and Asia have taken services offline while they patch two vulnerabilities that researchers discovered with AI models, as exploitation attempts rise into the millions. Two critical vulnerabilities in PHP or Hypertext Preprocessor, the programming language
[57]
Websites down: what is PHP and how has it raised AI hacking fears? - The Korea Times
Steve Kerrison, a senior lecturer in cybersecurity at James Cook University's Singapore campus, said some site operators might remain unaware of the issue for days, weeks or months. TOKYO -- Artificial intelligence has found critical security flaws in a major programming language called PHP, with
[58]
AI Finds Flaws Hiding in the Code Behind 70% of Websites | PYMNTS.com
Security flaws discovered with the help of artificial intelligence have triggered an urgent, OpenAI-led effort to protect websites worldwide, PYMNTS reported. The scramble exposes how quickly AI can uncover weaknesses in the software that supports online banking, payments and commerce. The
[59]
What to know about the AI-detected security bug impacting wide swaths of the internet
The language that's known as the backbone of the internet is now subject to what experts describe as one of the most notable vulnerabilities in recent memory. PHP is a widely used general-purpose scripting language that is geared toward web development, and thus, it powers the majority of websites
[60]
'Black October' shows how criminals use AI to cause real-world chaos -- but here's how you can protect yourself
The world has been plunged into a cyber-security crisis, known as "Black October," which exposed how vulnerable much of the world's online infrastructure is. Major security incidents, hacks and flaws across the globe have shown how easily online data stored by governments, companies and
[61]
AI-powered cyber threats light a fire under cybersecurity stocks By Investing.com
Investing.com -- An emergency security update for PHP, the programming language used by roughly 70% of websites worldwide, has triggered a global cybersecurity alert. Two critical vulnerabilities disclosed this week could allow hackers to take control of affected servers remotely. The incident
[62]
OpenAI Mobilizes Tech Firms to Fix Widespread Web Vulnerability | PYMNTS.com
The targets of this effort were critical vulnerabilities in PHP, an open-source programming language that is used to run websites and web applications, according to the post. The vulnerabilities were discovered and reported independently by Calif and Wiz, and then PHP's maintainers, supported by
[63]
AI-discovered bugs may soon trigger fresh disruptions, cyber experts say
Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to trigger more disruption along the lines of the outages that percolated across global government websites this week, according to seven cybersecurity professionals who spoke to
[64]
OpenAI's Sam Altman warns: smarter AI could expose deeper security flaws
OpenAI CEO Sam Altman says software security is running out of room with the old patch-the-bugs playbook. His point is that advanced AI models can now uncover vulnerabilities that fall outside the usual threat models, hardware included. Find the flaw, issue a patch, and hope people update before
[65]
AI cybersecurity vulnerabilities: How an AI model discovered critical safety flaws in government websites
A significant number of websites, including those managed by the French government and Wikimedia, faced downtime due to identified vulnerabilities in PHP, a popular web development language. Cybersecurity experts from Wiz and Calif employed AI to pinpoint these urgent flaws. In response, PHP
[66]
AI-discovered bugs may soon trigger fresh disruptions, cyber experts say
WASHINGTON, Oct 23 (Reuters) - Advances in artificial intelligence have uncovered a stream of new software vulnerabilities that are almost certain to trigger more disruption along the lines of the outages that percolated across global government websites this week, according to seven cybersecurity
[67]
Websites go dark as AI exposes critical security flaws
Government agencies and companies around the world shut down websites as they raced Thursday to protect themselves from hacks after artificial intelligence uncovered critical flaws in a widely used programming language called PHP. Wiz, one of the cybersecurity firms that found the two flaws,
[68]
How an AI-discovered flaw in PHP sparked a global security scramble
STORY: :: Washington, DC / October 21, 2026 :: Raphael Satter, Cybersecurity Reporter The entire internet is rushing to update their versions of PHP, whereas the entire cybercriminal underground is trying to figure out how do we weaponize this." // "The world woke up to news that PHP, which is a
[69]
AI security flaws: Some websites go dark as operators address an AI-detected flaw in a web programming language
An AI-assisted discovery of vulnerabilities in a widely used programming language led governments and other organizations in Europe and the U.S. to take their websites offline temporarily Wednesday as they scrambled to make security updates. The FBI's cyber division warned the vulnerabilities
Share
Copy Link
Researchers using AI discovered critical PHP vulnerabilities affecting an estimated 70% of websites worldwide. Amazon detected exploitation attempts four days before public disclosure, prompting emergency patches and government site shutdowns. The incident highlights AI's dual-use nature in cybersecurity—both finding and exploiting flaws.
AI Discovers Decade-Old PHP Vulnerability With Critical Impact
Researchers using advanced AI models uncovered critical security flaws in PHP, the open-source programming language that powers an estimated 70% of websites worldwide
1
4
. The PHP vulnerability, collectively dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, involves critical security flaws in how PHP manages computer memory and handles errors5
. Both vulnerabilities received a critical severity score of 9.2 out of 105
.
Source: Market Screener
Researchers from California-based cybersecurity firm Calif, working under OpenAI's "Patch the Planet" initiative, first identified the exploitable PHP vulnerability on August 11 using GPT-5.6 Sol
5
. OpenAI researchers independently discovered the same flaw that day, while Google-owned security firm Wiz identified an additional vulnerability5
. OpenAI characterized this as "one of the most impactful security issues in recent memory," noting that frontier AI found these vulnerabilities before attackers did1
.Hackers Exploit Critical Security Flaw Before Public Disclosure
Amazon detected attempts to exploit the PHP vulnerability four days before the weakness was disclosed to the public, giving hackers a significant head start
1
. The world's largest cloud computing provider warned that the flaws were "now being broadly exploited in the wild"1
. Cloudflare analysis revealed millions of exploitation attempts hit within hours of the vulnerabilities being published3
.The National Security Agency and UK's National Cyber Security Centre issued urgent warnings, with the NSA advising all organizations using PHP to immediately update their systems or take them offline
1
. Government websites in France, Denmark, Finland, and the Netherlands were taken offline as a precautionary measure4
. The National Cyber Security Centre warned the vulnerabilities could potentially allow remote code execution, enabling hackers to take control of a website's server without needing passwords or login credentials1
.
Source: PYMNTS
AI in Cybersecurity Reveals Two-Year-Old Flaw Human Developers Missed
The PHP Foundation had known about the underlying flaw since 2024 but couldn't identify an exploitation method or fix
5
. The issues were deemed too complex to exploit at the time3
. Human developers and security teams examined the underlying code but couldn't fully resolve the flaws, allowing them to persist for two years after discovery5
. Meanwhile, AI-assisted researchers demonstrated practical ways to exploit it within two weeks5
.According to University of Surrey researcher Alan Woodward, the flaw requires millisecond timing to exploit—previously thought impractical for human hackers. "The reason it was thought to be too complicated was it would have taken a team of people yonks to actually work out the right timings. But what AI does, it doesn't go for tea breaks, it doesn't go home at six o'clock: you can just set loads of them running and eventually they'll come up with the right answer," Woodward explained
4
. Wiz researcher Sagi Tzadik noted, "The vulnerability had been known to the PHP team for years, but because it could not be leveraged by an attacker—at least, not a human one—it was not addressed"3
.Memory Handling Errors Enable Remote Code Execution
The two vulnerabilities involve flaws in how PHP manages computer memory and handles errors
5
. The first occurs when PHP runs out of allocated memory while processing a request, potentially leaving behind incomplete internal data that the engine may later mistakenly treat as valid4
. The second involves a related problem where a fatal error leaves PHP pointing to memory that has already been freed, allowing subsequent requests to access or corrupt it4
.
Source: AIM
Under certain conditions, attackers can exploit these weaknesses remotely to execute malicious code on affected servers, potentially taking control of websites
5
. Using large language models, researchers demonstrated that the flaws could expose sensitive information stored in server memory, including passwords, authentication tokens, and API keys5
. The vulnerabilities exist in PHP's core engine, meaning websites can be affected even if their application code has no security flaws5
.Related Stories
Patching Efforts and Long-Term Concerns About Internet Infrastructure
The PHP Foundation released patched versions PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to fix the vulnerabilities
5
. PHP 8.1 and older versions will not receive official fixes5
. The coordinated release was originally scheduled for October 22 but was brought forward to October 21 following premature disclosures on October 205
.PHP's wide presence stems largely from WordPress, the most widely used website-building platform, which is written primarily in PHP
1
. The incident sparked concerns about the rickety infrastructure of the internet, with experts noting how much of the web's foundation relies on open-source technology maintained by small teams2
. Some organizations took websites offline entirely rather than patch them, raising concerns about link rot and the permanent loss of historical web content2
.Defender's Window Concept and AI's Dual-Use Nature
OpenAI introduced the concept of the Defender's Window following this incident—a critical, narrow timeframe during which organizations can use advanced frontier AI models to find, patch, and strengthen cybersecurity defenses before those same AI-driven attack capabilities become widely available to malicious threat actors
5
. The company emphasized that "frontier AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits"1
.This dual-use nature of AI in cybersecurity has prompted warnings from politicians and financial regulators. The release of new models earlier this year from Anthropic and OpenAI with powerful cyber capabilities led the US government to temporarily limit their rollout
1
. Anthropic's Claude Mythos recently identified thousands of zero-day vulnerabilities in every major operating system and web browser5
. Security researchers note that while AI makes bugs more exploitable, most sophisticated AI-assisted hacking still involves human expertise, with Calif researcher Ryan Austin writing, "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now"3
.References
Summarized by
Navi
[4]
Related Stories
AI-Powered Cyberattacks Overwhelm Cybersecurity Teams as Threat Landscape Transforms
27 Oct 2026•Technology
AI Turns Cybersecurity on Its Head: Exploits Now Outpace Patches by Weeks
05 Nov 2026•Technology
AI Models Break Out of Testing Labs and Hack Real Systems as Security Pass Rates Stall at 56%
28 Jul 2026•Technology
Recent Highlights
1
Jensen Huang's Affair with Suspected Chinese Spy Exposes $7 Billion AI Chip Smuggling Network
Policy and Regulation
2
Anthropic Launches Claude Meetings and AI-Powered Office Tools to Challenge Microsoft and Google
Technology
3
Samsung Smart Glasses With Google Gemini AI Open for Pre-Orders November 12th
Technology
Recent Highlights
Today's Top Stories
Don’t drown in AI news. We cut through the noise - filtering, ranking and summarizing the most important AI news, breakthroughs and research daily. Follow topics that matter to you and stay ahead.
