Security researchers using an OpenAI model have uncovered two stunning security flaws in PHP, the software that underpins nearly 70 percent of all websites on the internet.
The flaws are so catastrophic that all websites using PHP — all untold millions of them — are advised to immediately take their servers down and apply the latest patch, which was released Wednesday. Vast swathes of the internet, following the news, have gone dark. Some that went offline for a time include Wikipedia, Steam, and even government websites.
Many organizations, however, may not have the time, resources, and personpower to swiftly implement the patch, making them potential sitting ducks until they do. According to the New York Times, the information released on the vulnerability can be used to reverse engineer the attack and take control of victim’s servers and steal information. The best course of action if you can’t patch your website, the National Security Agency advised, is dramatic: keep your site offline and don’t turn it back on.
Just as extraordinary as the breadth of the threat was how it was identified. The flaws were discovered by researchers at the cybersecurity firm Calif by using OpenAI’s GPT-5.6 Sol model, as part of a collaboration with the AI company. It then reported the flaw to the PHP Foundation back on August 11.
The Google-owned security firm Wiz independently found the flaws, too, and made a report on August 24. Wiz called it one of the “most severe vulnerabilities discovered in PHP, and arguably in software history.”
Adding to the alarm presented by the exploits, there have been concerns raised over OpenAI’s role in how they were identified.
The flaws have been present in versions of PHP dating backing to 2004. But through OpenAI’s “Patch the Planet” program, and by using its flagship GPT-5.6 Sol model, Calif found it in only a matter of days. In a sense, these exploits only exist because of current powerful AI models. And moreover, OpenAI encouraged their discovery through its programs.
The messy disclosure of the vulnerability doesn’t help matters. OpenAI followed standard responsible practices, but some of the details around the hack leaked a day before it was officially scheduled to be announced.
Even if no leaks occurred, though, the damage caused by the mere knowledge that the vulnerabilities exist — which again, is largely thanks to AI — would still be catastrophic. It was the inevitable next chapter in all the bluster around AI companies revealing their agentic models’ hacking prowess. A headline in The Atlantic proclaimed that the “AI-Hacking Apocalypse Began Last Night.” OpenAI will tout the discovery as undeniable proof of its AI’s capabilities, while the rest of the world picks up the pieces of a shattered internet.
More on AI: AI Experts Already Doomsday Prepping for When AI Takes Out the Entire Financial System
The post Frontier OpenAI Model Exposes Stunning Exploit That Leaves Millions of Web Servers Open to Attack appeared first on Futurism.
Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it's far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if "an immediate update is not feasible," as did the UK's National Cyber Security Center. Even Pokémon Home and Pokémon C …
Taking a site offline to patch PHP? Serve a 503 from outside PHP and keep robots.txt reachable. Days of server errors may get URLs dropped.
The post Google Reminds Sites To Serve A 503 During PHP Patch Downtime appeared first on Search Engine Journal.
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.
[…]
Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.
[…]
The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.
Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.
Word on the street is that these exploits have leaked, and that remote code can likely be executed all the way back to PHP 5. If you have access to your website’s
php.inifile, it might be worth turning off multipart uploads for now.
Two changes reduce the risk until the fixed versions are out. They were checked against PHP’s source code and the PHP manual, but they are not an official PHP mitigation. When someone suggested that turning off session upload progress might be enough, PHP core developer Gina Peter Banyard replied, “The only thing I can say is that the only mitigation is patching / upgrading PHP. I sadly know too much.” Use the stopgaps to lower the risk for a few hours, and update PHP as soon as the fixed builds exist.
Add to php.ini:
session.upload_progress.enabled = Off
Add to .htaccess:
Login<If "req('Content-Type') =~ /multipart/i">
Require all denied
</If>
I've used Bitdefender Total Security to protect my own devices for years, and I highly recommend it. I've found a great deal on the security software at Newegg that brings a year's coverage for up to 10 devices down to under $30.
Bitdefender Total Security 2026 is reduced to $28 (was $100) at Newegg with promo code EPF56892. It doesn't get much cheaper than this, so well-worth checking out.
• Best for: Households with multiple devices, anyone wanting protection across different operating systems, and people looking for antivirus software with additional privacy and ransomware defenses.
• Why I like it: I use Bitdefender Total Security to protect all of my devices at home, and it's much more than a traditional antivirus tool. As well as keeping you safe from viruses, spyware, Trojans, ransomware, and other malicious software, it also uses behavioral detection to identify suspicious activity and defend against unknown threats.
Total Security 2026: was $99.99 now $27.99
Bitdefender Total Security provides one year of protection for 10 Windows, macOS, Android, and iOS devices, with malware detection, ransomware defense, privacy tools, parental controls, and limited daily VPN access included.View Deal
The software can block online tracking, monitor attempts to access your webcam or microphone, and identify potentially dangerous websites. The subscription covers up to 10 devices running Windows, macOS, Android, and iOS.
The package also includes access to Bitdefender VPN, although it's limited to 200MB per day per device, which is only really enough for occasional use. Parental control features will be of interest to anyone with children, although availability and functionality depend on the OS.
In covering the software, we said: "Bitdefender tops our list and ticks every box. It performed well across our testing, boasts all the tools you need to protect your devices from malware (and more), and is nice and easy to use – regardless of platform. While some expert users might wish for a little more granular customization, we think that Bitdefender strikes the right balance in terms of configuration and ease of use."
Newegg sells the one-year, 10-device subscription for $99.99, but is currently offering it at $52.99. Enter EPF56892 at checkout to save a further $25, bringing the final price to $27.99.
That represents a $72 saving against the original price, approximately 72% off. If you activate the program on all 10 devices, the first-year cost works out to approximately $2.80 per device.
It's important to remember that this is a one-year license, rather than a permanent software purchase. You're not locked in though. What I usually do is search for a new deal around the renewal time.
For more options, take a look at our roundup of the best antivirus software.
✅ Buy the Bitdefender Total Security if...
You want one antivirus subscription covering Windows, Mac, Android, and iOS devices. It's also great for ransomware protection, malicious website detection, and privacy tools. At $27.99, this is a fantastic deal.
❌ Skip Bitdefender Total Security if...
You only need to protect one computer and are satisfied with your device's built-in antivirus software. Windows includes Microsoft Defender, and macOS and mobile operating systems have their own security protections.
Google is stepping up its fight against deceptive websites with a fresh batch of security tools. As bad actors constantly change their tactics to trick users, the popular web browser is bringing in new layers of defense to its Enhanced Protection mode. These updates aim to catch more threats in real time, from sneaky fake […]
The post Google Chrome Deploys Stronger Defenses Against Online Scams appeared first on The Mac Observer.
PHP, arguably the most popular programming language for websites and web applications in the world, contains two critical-level vulnerabilities that could expose countless sites to remote code execution (RCE) attacks, the provider has revealed.
The flaws could lead to website takeovers, data theft, malicious redirects, and a whole swathe of similarly sinister situations.
PHP published a new security advisory, giving admins a “heads up” on an incoming patch.
“The PHP security team would like to give advance notice of an upcoming security release,” the advisory reads.
“It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available. We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.Full details, affected versions, and the fixed versions will be published with the release.”
If you’re thinking the announcement is rather unorthodox and that PHP might as well just released the patch - you’re absolutely right. The problem is that someone spilled the beans on the vulnerabilities before the official embargo was lifted, having the cybersecurity community scrambling for answers.
That ‘someone’ is a person with an alias ‘petecooper’, who published a new post on Y Combinator’s Hacker News forum earlier this week. In the post, they claimed PHP would disclose two remote code execution bugs on October 22 2026.
The post has since been deleted so we couldn’t independently verify it, but BleepingComputer says the post claimed the bugs carried CVSS scores of 10.0 and affected PHP versions dating back to PHP 5.
The post also labeled the bugs as CVE-2026-109618 and CVE-2026-109619, which was subsequently confirmed. Therefore, the only thing that’s wrong is the CVSS score which seems to be 9.2, not 10.0.
Among the people who knew about the flaw and the upcoming patch were watchTowr, and Florian Roth, Head of Research at Nextron Systems.
The embargo on the news was set for October 20, with the patch due a day later, on October 21. However, yesterday Roth posted on X, saying “Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.”
This forced PHP’s hand, not just to release the advisory, but also to send a notice to its ANNOUNCE mailing list, according to BleepingComputer.
Security researchers watchTowr confirmed the news, saying the bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and that the duo is being nicknamed “php2shell” by the community. Obviously, technical details are being withheld to protect users, but most likely affect PHP versions 5, 6, 7, and 8.
"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.
"While we are not able to share technical information at this point for obvious reasons, given the sensitivity, we can confirm that these vulnerabilities are indeed real. Both of them are CVSS10 and are understood to affect PHP versions 5, 6, 7, and 8."
The researchers also told the publication they managed to successfully reproduce CVE-2026-109618, confirming the flaws actually work. Good news is, there are still no confirmed reports of the flaws being used as zero-days in the wild.
