Critical PHP security flaws spark global website outages
A set of critical vulnerabilities in PHP, a language powering 70% of websites, was uncovered using frontier AI models. This has triggered a global rush to patch systems, with some organizations taking websites offline as a precaution to prevent remote code execution and data theft.
What happened
- Earlier
Wiz Research uses AI to find severe flaws in PHP that had existed for decades [1].
- 21 Oct, 2026
PHP releases patches to fix multiple memory-safety vulnerabilities in its core engine [1].
- 22 Oct, 2026
Cloudflare reports millions of exploit attempts following the public disclosure of the flaws [3].
- 22 Oct, 2026
The UK government takes 32 services offline and four others partially offline as a precaution [2].
What you need to know
The flaws affect nearly every PHP version from 5.4 onwards [1].
Attackers could potentially steal API keys, passwords, and certificates or take control of servers [1].
PHP is the foundation for major platforms including WordPress, Wikipedia, and Drupal [1].
Immediate patching is strongly advised for all users [1].
It is not yet confirmed if any successful breaches have occurred, though experts say the full impact may take months to appear [2].
Background
PHP is a general-purpose scripting language created in the early 1990s. It acts as the back-end code that collects data and turns it into readable web pages for users [2]. These specific vulnerabilities, grouped under two CVEs with severity scores up to 9.2, were previously hidden because they required a complex chain of steps to exploit. Frontier AI models made it possible to develop working exploits in hours, reducing the barrier that human researchers previously faced [1].
Questions people ask
Which websites are at risk?
Any site using PHP, including those powered by WordPress, Joomla, Drupal, and MediaWiki, is potentially affected [1].
How did AI play a role in this?
AI was used to uncover the flaws and drastically reduce the time and expertise needed to create practical exploits from longstanding code issues [1].
Where this came from
[1] wiz.io
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
Preview image from wiz.io
[2] bbc.com
Race to update services' computer systems after cyber-security flaw found
Preview image from bbc.com
[3] channelnewsasia.com
Cloudflare sees millions of exploit attempts after PHP disclosure
Preview image from channelnewsasia.com
Found through Google Trends and drafted with AI from at least two cited sources. Published automatically after passing our automated checks for sources, wording and safety. It may not have been reviewed by a person yet. Report a correction.