AI-Discovered PHP Flaws Spark Global Cyber Emergency

A pair of critical vulnerabilities in PHP, the programming language powering an estimated 70% of the world's websites, has triggered a global cybersecurity scramble. Discovered with the help of AI, the flaws—tracked as CVE-2026-109618 and CVE-2026-109619—each carry a severity score of 9.2 and allow unauthenticated remote code execution. Source: ZDNet Cloudflare CEO Matthew Prince reported seeing millions of exploitation attempts within hours of the public disclosure. Source: The Next Web

Discovery and Disclosure

The vulnerabilities were uncovered by researchers at Calif and Wiz, working under OpenAI's "Patch the Planet" initiative. Source: Tom's Hardware A flaw known since 2024 that had stumped human developers was turned into a working exploit by AI in just two days. Source: CNN The PHP Foundation released emergency patches for versions 8.2 through 8.5 on October 21, a day ahead of schedule after the news embargo was accidentally broken by a Hacker News user who said they were unaware of the restrictions. Source: Tom's Hardware

Global Impact and Response

Organizations worldwide have taken websites and services offline as a precaution. In Japan, SoftBank suspended emergency alert messages, including earthquake and tsunami warnings, while patching. Source: The Next Web The UK took 32 government services offline, and the Internet Archive was briefly forced down. Source: BBC, The Verge Singapore's Cyber Security Agency called the threat "immediate." Source: South China Morning Post American Express experienced disruptions but said they were not security-related. Source: Gizmodo

The Role of AI

Security experts warn that AI has lowered the barrier to exploiting such vulnerabilities. "This may be the first of many. This is a wakeup call," said Carnegie Mellon professor Vyas Sekar. Source: CNN Anthropic's deputy CISO Jason Clinton wrote, "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." Source: Gizmodo