PHP Flaws Found by AI Trigger Global Cybersecurity Alert — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP powers 70% of the world's websites, including Wikipedia and WordPress, and has been found to contain two critical flaws—CVE-2026-109618 and CVE-2026-109619—ranked 9.2/10 in severity.
- Wiz and Calif researchers used AI tools developed by OpenAI to detect the decade-old PHP vulnerabilities, which could allow hackers to take control of web servers and steal data.
- The PHP Foundation released emergency patches on Wednesday, urging all users to update immediately, as the flaws affect PHP versions released over the past ten years.
- Wikimedia, the Finnish government, Edinburgh council, and the Netherlands' cyber-security agency took systems offline preemptively, with 32 UK government sites also temporarily suspended.
- US National Security Agency advised organizations using PHP to take systems offline if they can't patch immediately, calling the risk severe enough to require urgent action across federal departments.
- Cloudflare's Matthew Prince reported millions of exploit attempts within hours of public disclosure, with attack volume surging from thousands to millions post-announcement.
Why it matters: The discovery exposes millions of websites and embedded systems to potential compromise, with small organizations at higher risk due to limited resources. The speed of attack scaling—jumping from thousands to millions of attempts in hours—makes immediate patching critical, especially since PHP underpins not just websites but network infrastructure often overlooked in updates.
Ask SkimNews
