Science & Tech · Cybersecurity · 2 hrs ago
Critical PHP flaws trigger urgent security fixes as AI speeds up attacks
Critical flaws in PHP prompted organizations to rush out fixes on Thursday.
PHP is a programming language used by about 70% of websites, and the flaws could let attackers run code on affected servers.
The US National Security Agency advised organizations using PHP to update their systems or take them offline until they could.
AI can help researchers find flaws faster, but can also help attackers exploit them, making the risks harder to manage.
Some websites were taken offline as a precaution, and Amazon said it detected an attempt to exploit the flaws before they were publicly disclosed.
The immediate priority is for organizations to install patches and check for signs of compromise; people can also keep their devices and apps updated and be wary of urgent security messages.
Experts say the incident shows why governments and technology companies need to cooperate on AI security, though international regulation faces political obstacles.
Critical vulnerabilities in PHP, which powers about 70% of websites, prompted organisations to install fixes or take affected systems offline.
The flaws could let attackers run code on affected servers and potentially steal data, disrupt services or move through networks.
AI helped researchers uncover the flaws, but it may also make it easier to develop and scale attacks.
Cloudflare reported that attempts to exploit the PHP flaw rose from thousands before public disclosure to millions afterward.
Security experts said organisations need to identify affected systems, patch them promptly and check for signs of compromise.
- Who
- Organisations using PHP were urged to act. Attackers were reported to be attempting to exploit the flaws.
- What
- Two PHP vulnerabilities can enable remote code execution on affected systems, prompting urgent security fixes.
- When
- The flaws were publicly reported on October 22, 2026. Sources also describe security incidents and disclosures over the preceding 48 hours.
- Where
- The vulnerabilities affect PHP systems used around the world.
- Why
- The flaws could let attackers run code on affected servers. AI may make vulnerabilities easier to find and exploit.
AI regulation advocates
Donald Trump
Global regulation
AI regulation advocates
Advocates argue that international cooperation and regulatory frameworks are needed to manage AI risks.
Donald Trump
Trump rejects international negotiations on AI regulation, viewing US leadership in advanced AI as a strategic asset.
Approach to AI development
AI regulation advocates
Advocates warn that malicious or accidental uses of AI could cause severe harm and argue for caution.
Donald Trump
Trump has framed AI as a race for global supremacy, saying, “Whoever wins AI, wins.
Multiple security flaws and vulnerabilities were reported online, including the PHP flaws.
Cloudflare saw thousands of attempts to exploit the PHP vulnerability across its network.
Cloudflare said attempts had risen to tens of thousands.
Cloudflare said attempts had reached hundreds of thousands.
Organisations around the world scrambled to fix PHP flaws, and some websites were taken offline as a precaution.
- PHP share of websites
- Roughly 70%
- PHP vulnerability identifiers
- CVE-2026-109618 and CVE-2026-109619
- Cloudflare attempts before public disclosure
- Thousands in the 10 hours before disclosure
- Cloudflare attempts after public disclosure
- Tens of thousands in 45 minutes; hundreds of thousands within two hours; millions later
- NSA advice
- Update PHP systems immediately or take them offline until they can be updated
6 sources
Use MFA, patch, beware of scammers: 5 ways to keep safe online in the wake of AI-supercharged hacking
The Guardian view on AI safety: the push for global regulation must advance | Editorial
The Internet Is Currently On Fire
Global race to update computers as AI discovers most disruptive hack yet
PHP脆弱性“PoCフライング公開”の経緯、支援財団が公表 混乱広げた企業を名指しで批判
The internet is having a very bad cybersecurity day
What people are saying
In the 10 hours before [the PHP vulnerability] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Pre-AI, this manual work would be difficult to implement and even harder to scale[…]This changes the economics of both discovery and exploitation. As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.
Finding vulnerabilities is becoming faster and easier, but fixing them across the range of systems that rely on this software is much harder.
Whoever wins AI, wins.
Posts on X
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.