Services Rush to Patch Systems After Cybersecurity Flaw Emerges

WHO:

NPR - The U.S. National Security Agency warned organizations using PHP to “maintain heightened awareness”; the U.K.’s National Cyber Security Center urged organizations to “take immediate action” to update websites.

NPR - Japanese Prime Minister Sanae Takaichi issued “an urgent request for everyone to take action” and said temporarily suspending websites could reduce risk if patches could not be applied promptly.

The Atlantic (via Techmeme) - Ondřej Surý is a volunteer who maintains PHP and automates its patches.

CNN - Security researcher Stefan Esser warned about a critical PHP flaw in July 2004.

CNN - Ryan Austin said Calif did not use AI models unavailable to the public.

CNN - Vyas Sekar, a Carnegie Mellon University professor of computer engineering, called the discovery “a wakeup call.”

CNN - Nick Rogers, CEO of Fieldwork AI, said “security by exhaustion” is no longer a viable safeguard.

CNN - Adam Meyers, CrowdStrike’s vice president of counter adversary, warned that many outdated PHP versions remain in use.

CNN - Madhu Shashanka, Concentric AI cofounder, said, “Everything is a potential vulnerability.”

The Verge - Amazon Chief Information Security Officer CJ Moses reported the exploitation attempts.

The Verge - PHP Foundation Executive Director Elizabeth Barron said there had been no known successful remote code execution.

BBC - Developers of the programming language PHP announced that critical vulnerabilities had been discovered.

BBC - PHP is widely used across the internet.

WHAT:

NPR - Dozens of British and Finnish government services were taken offline; local government sites in France were briefly taken down.

NPR - Cloudflare head Matthew Prince said the firm saw tens of thousands of exploitation attempts in the first 45 minutes after discovery, rising to millions.

NPR - China’s Industry Ministry urged entities to review security gaps.

NPR - Wiz Research said successful exploitation could let attackers take control of affected servers, steal sensitive data, and deface websites.

NBC News - Experts reported few, if any, cases of widespread damage from hackers exploiting the PHP flaws.

NewsBTC - The PHP advisory did not announce a breach of Bitcoin or BTCPay Server itself.

CNN - PHP powers 70% of the world’s websites.

CNN - A related PHP problem was found in 2020 and received a partial fix; a similar vulnerability was identified in 2024 but remained unfixed.

CNN - Calif and OpenAI researchers found a PHP attack method on August 1, then additional methods; Google-backed Wiz later found new PHP exploits.

CNN - Cloudflare said thousands of exploits occurred in the hours before the patch announcement, following an apparent vulnerability leak.

CNN - OpenAI’s Mythos model deployment was paused in June after the model’s vulnerability-discovery capabilities led the US government to label it a national security threat.

The Verge - The PHP flaws affected sites across the web, including WordPress sites.

The Verge - Amazon Threat Intelligence found several other exploitation attempts on October 21, in the hours before the patch’s release.

The Verge - The PHP Foundation said it would prioritize measures to resolve future vulnerabilities requiring complex fixes faster.

The Verge - The vulnerabilities were identified as CVE-2026-109618 and CVE-2026-109619 and could allow remote execution of malicious code on vulnerable devices.

The Verge - Amazon Threat Intelligence detected a PHP2Shell exploit attempt against a honeypot and several other exploitation attempts.

The Verge - The PHP Foundation said it was changing processes to help leadership resolve complex vulnerabilities faster.

BBC - Websites were taken offline after developers announced the vulnerabilities.

BBC - Websites were taken down worldwide as a critical cybersecurity update was issued.

BBC - The vulnerabilities were described as the most significant ever found by AI.

WHERE:

NPR - Organizations in the U.K. and Japan were among those rushing to prevent attacks; reported government-service outages affected Britain, Finland, and France.

WHEN:

The Verge - The PHP Foundation first theorized the bug in 2024.

The Verge - Amazon Threat Intelligence detected a PHP2Shell exploit attempt on October 17.

WHY:

The Verge - The PHP Foundation said coordinating changes to many third-party extensions seemed impossible.

The Verge - The PHP Foundation said the fix had been delayed because of backward-compatibility breaks, potential denial-of-service risks, and required changes to numerous third-party extensions.

BBC - Websites were taken offline following discovery of the critical vulnerabilities in PHP.

HOW:

CNN - OpenAI’s Patch the Planet initiative partnered with Calif on the PHP security research; Google-backed Wiz also participated in the initiative and identified additional exploits.

CNN - Security researcher Stefan Esser’s warning about the PHP flaw was sent in July 2004.

CNN - OpenAI recommended writing more secure code; CrowdStrike’s Adam Meyers said migrating away from PHP would require rebuilding applications.

NewsBTC - The advisory urged crypto businesses using PHP-based web infrastructure to check that layer of their systems.

CNN - The flaw could leave stale data after a server ran out of memory, enabling data leaks or malicious code execution.

CNN - Researchers demonstrated attacks using mismatches in PHP’s handling of compressed and decoded files, and deeply nested file structures that could trigger memory failure.

CNN - Adam Meyers said exploiting the vulnerability after disclosure remained possible because many outdated PHP versions were still in use.

The Verge - Amazon Threat Intelligence said the honeypot was targeted from an anonymized IP address; Amazon said it remained unclear how the actor obtained exploit information before disclosure.

The Verge - The Verge reported that details about the vulnerabilities began appearing on forums and social media as the PHP Foundation prepared to release the fix; some security firms disclosed information before the official release.

The Verge - Amazon’s security team detected the honeypot attempt through a monitoring system designed to bait hackers.

BBC - Services were rushing to update their computer systems after the cybersecurity flaw was found.

(UPDATED October 23, 2026 15:20 UTC)

A critical flaw in PHP, the software behind about 70 percent of the world’s websites, triggered urgent security updates and temporary shutdowns. The vulnerabilities could let attackers run malicious code, steal sensitive data or take control of servers, and affected sites including WordPress. Researchers from Calif and OpenAI’s Patch the Planet initiative uncovered attack methods, while Google-backed Wiz identified additional exploits. Cloudflare reported tens of thousands of attempts shortly after discovery, rising to millions, and Amazon detected attacks on a honeypot before the patch was released. There have been no known successful remote code executions or widespread damage, but experts warn outdated PHP versions remain vulnerable. Government services in Britain and Finland went offline, while French local-government sites were briefly taken down. U.S., U.K. and Japanese officials urged organizations to patch immediately, and the PHP Foundation said it would speed up its response to complex vulnerabilities.

(UPDATED October 23, 2026 13:18 UTC)

Two critical flaws in PHP, the programming language powering about 70% of websites, triggered emergency updates and outages around the world. The vulnerabilities could let attackers run malicious code, steal data, or take control of affected servers, including sites built on WordPress. Security teams recorded tens of thousands of exploitation attempts within 45 minutes of discovery, eventually rising to millions, though experts reported little evidence of widespread damage. Britain and Finland took dozens of government services offline, while local government sites in France were briefly shut down. Officials in the U.K., Japan, and China urged organizations to act, and Japan’s prime minister said temporarily suspending websites could reduce risk if patches could not be applied quickly. Amazon detected attempts against a decoy server before the fix was released, as details circulated online.

(UPDATED October 23, 2026 11:04 UTC)

PHP developers issued a critical security update after discovering two flaws that could let attackers run malicious code on vulnerable systems. PHP powers much of the web, including WordPress sites, and the problems prompted websites worldwide to go offline as services rushed to install the fix. Amazon reported attempts to exploit the vulnerabilities, including an attack on a monitoring honeypot, but PHP Foundation Executive Director Elizabeth Barron said there were no known successful remote code executions. Cloudflare also reported thousands of exploit attempts in the hours before the patch, after details apparently leaked. Researchers said the flaws could leave stale data when servers run out of memory, creating opportunities for data leaks or code execution. The fix was delayed by compatibility concerns and the need to update third-party extensions. Experts warned that outdated PHP versions remain in use, and urged businesses to check their systems.

(UPDATED October 23, 2026 10:06 UTC)

Developers of PHP, the widely used programming language behind about 70% of websites, disclosed critical vulnerabilities that could let attackers run malicious code on affected systems. The flaws also put sites including WordPress at risk, prompting services worldwide to take systems offline and rush out updates. Researchers found that failures involving memory and compressed files could leave stale data exposed or create an opening for attacks. Security teams detected exploit attempts before the patch was released, including one targeting an Amazon honeypot, though the PHP Foundation reported no known successful remote code execution. The fix was delayed by backward-compatibility problems, denial-of-service concerns, and the challenge of updating third-party extensions. Researchers said related problems had been identified earlier, while many outdated PHP versions remain in use. Carnegie Mellon professor Vyas Sekar called the discovery “a wakeup call,” and the foundation said it would speed up its handling of complex vulnerabilities.

(UPDATED October 23, 2026 01:31 UTC)

Developers of PHP, a programming language used across much of the internet, have disclosed two critical vulnerabilities that could let attackers run malicious code on affected systems. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, prompted websites, including WordPress sites, to go offline as services rushed to install a security update. The PHP Foundation said it had found no known successful remote code execution. Amazon’s threat intelligence team detected a PHP2Shell exploit attempt against a monitored honeypot, as well as several other attempts. The activity included an attempt on October 17 and further attempts on October 21, before the patch was released. Amazon said it was unclear how the attacker learned about the exploit, as details circulated online ahead of the official release. The Foundation said the fix was delayed by compatibility concerns, denial-of-service risks, and changes needed across third-party extensions. It plans to speed up responses to complex vulnerabilities.

(UPDATED October 23, 2026 00:08 UTC)

Developers of PHP, a programming language used across much of the internet, announced critical vulnerabilities that could let attackers run malicious code on affected devices. Websites were taken offline worldwide as services rushed to install a security update, and the flaws were described as the most significant ever identified by artificial intelligence. Amazon Threat Intelligence detected a PHP2Shell exploit attempt on October 17 through a monitoring system designed to attract hackers. It later found several more attempts on October 21, in the hours before the patch was released. Amazon’s Chief Information Security Officer, CJ Moses, reported the activity, while the PHP Foundation’s executive director, Elizabeth Barron, said there were no known cases of successful remote code execution. The fix had been delayed because of compatibility problems, denial-of-service risks and changes needed for many third-party extensions. The foundation says it is changing its processes to speed up complex security fixes.

(UPDATED October 22, 2026 22:13 UTC)

Developers of PHP, a programming language widely used across the internet, have disclosed critical vulnerabilities that prompted websites worldwide to go offline while services rushed to update their systems. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, could let attackers run malicious code on vulnerable devices. They were described as the most significant vulnerabilities ever found by AI. Amazon Threat Intelligence detected a PHP2Shell exploit attempt against a honeypot, along with several other attempts. Amazon’s security team uses the monitoring system to lure and detect hackers. Amazon Chief Information Security Officer CJ Moses reported the activity, while PHP Foundation Executive Director Elizabeth Barron said there were no known cases of successful remote code execution. The foundation said the fix was delayed by backward-compatibility problems, denial-of-service concerns, and changes needed across numerous third-party extensions. It is changing its processes to help leadership resolve complex vulnerabilities faster.

(UPDATED October 22, 2026 19:23 UTC)

Websites around the world were taken offline as developers of PHP, a programming language widely used across the internet, announced critical security vulnerabilities. The flaws were described as the most significant ever found by artificial intelligence. In response, a critical cybersecurity update was issued, and services rushed to update their computer systems. The disruption followed the discovery of the vulnerabilities, with websites taken down while operators worked to address the risk. PHP is used by many online services, so the security alert prompted urgent action across the web. Developers and service operators are now focused on applying the update to protect affected systems. The scale of the response reflects the seriousness of the flaws and the widespread use of the programming language. The announcement brought immediate changes for websites as they worked to restore service safely.