Understand this story
On October 22, 2026, the U.S. National Security Agency (NSA) issued a warning, stating that AI tools discovered two critical security vulnerabilities in PHP. According to Wallstreetcn, the PHP development team released an emergency patch the same day and urged users to update immediately; Google's Wiz AI vulnerability research tool Wiz Atlas, combined with Gemini 4 Argon and OpenAI's GPT-5.6 Sol, was the first to discover the flaws, and another security company, Calif, said it independently discovered the same vulnerability on August 1 with the help of a large language model. According to Censys data, of about 2.6 million hosts running PHP, about 1.5 million use versions for which no patch is available, and government websites in the Netherlands, France, Denmark, Finland and other countries have been urgently taken offline as a precaution. Deutsche Welle Chinese later reported that the PHP development team released an emergency security update on October 21 to fix critical vulnerabilities present in all PHP versions over the past 20 years, and cybersecurity companies said some hackers have begun exploiting the vulnerabilities to launch attacks; Japan's Nomura Securities, Mitsubishi UFJ, All Nippon Airways, East Japan Railway, as well as the Dutch government portal, the Port of Rotterdam, and some Wikipedia systems, have suspended related online services. On October 23, Amazon disclosed that attackers began probing four days before the patches for the two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were released, and its MadPot honeypot network recorded the earliest attempt on October 17; Clo
AI-generated from public reports
Latest update · Discussion
English text is being prepared. joined this discussionDevelopments
2 confirmed developments
Amazon discloses PHP2Shell attacks appeared four days before the patch
Source:SiliconANGLE- Source:Wallstreetcn
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 25
English text is being prepared.Related discussion
English text is being prepared. joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Oct 24
The Guardian Technology
Guardian: Security experts warn AI-driven hacking has entered a new phase, PHP vulnerability triggers "Black October"
The Guardian reports that researchers used AI to find a decades-old critical vulnerability in PHP that could affect about 70% of websites; government and private sites were temporarily taken offline to patch, and the NSA issued an alert. Anthropic's Jason Clinton said a "vulnerability tsunami" will arrive in the coming months; Cloudflare's Matthew Prince said exploitation attempts rose from thousands to hundreds of thousands within 2 hours of the announcement and now reach millions; Sam Altman said he "no longer thinks we can patch all bugs."
Oct 23
Wallstreetcn
Cybersecurity experts warn that AI accelerates vulnerability discovery, and large-scale security incidents may occur frequently in the coming months
Multiple cybersecurity experts warn that the AI-driven wave of vulnerability discovery could lead to more large-scale website outages in the coming months similar to those caused by the PHP vulnerability this week. Cloudflare CEO Matthew Prince told Reuters that there are still many serious vulnerabilities in other known critical software being patched, and he expects sustained high-pressure conditions for years to come. Research soon to be released by VulnCheck shows that AI's involvement has driven the number of digital vulnerabilities discovered this year to double year-over-year, but some experts believe that increased disclosure does not necessarily mean a higher attack success rate.
BBC Chinese
AI discovers high-severity PHP vulnerabilities php2shell, institutions in multiple countries worldwide rush to patch
Cybersecurity companies Wiz and Calif, with the help of OpenAI technology, discovered two security vulnerabilities in the PHP language collectively called php2shell, affecting multiple PHP versions over the past decade or more; about 70% of websites worldwide use PHP. The PHP Foundation has released patches, and institutions including the US NSA, the UK NCSC, and bodies in the EU, Singapore, and Australia urged website operators to update immediately, and those unable to patch should consider temporarily shutting down their websites. Some websites including Wikipedia, the Finnish government, Edinburgh City Council, and the BBC have suspended operations; Cloudflare said attack attempts rose from thousands to millions after the vulnerabilities were disclosed.
SiliconANGLESelected
Amazon says PHP2Shell attacks began four days before the patch release, and Cloudflare recorded millions of attempts
Amazon disclosed that attackers began probing four days before the patches for the two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were released, with its MadPot honeypot network recording the earliest attempt on October 17, when the vulnerabilities were still under embargo. Cloudflare CEO Matthew Prince said that tens of thousands of attempts appeared within 45 minutes of the announcement, reaching hundreds of thousands within two hours, and by the time he posted, more than one million. Defiant said its Wordfence firewall had blocked more than 74,000 exploitation and probing attempts, and among more than 5 million WordPress sites no successful intrusion had yet been confirmed; institutions including Japan's Nomura, Mitsubishi UFJ Financial Group and East Japan Railway suspended some internet services.
Shanghai Observer
AI discovers critical PHP vulnerabilities, putting about 70% of websites worldwide at risk
Researchers used AI technology to discover two critical security vulnerabilities in PHP, and the NSA warned organizations to patch them immediately. Data from W3Techs shows that about 70% of websites worldwide use PHP and may therefore face the risk of hacker attacks. On the same day, OpenAI fully opened its decision API, with input pricing at $0.10 per million Tokens.
Oct 22
Jiwei.comSelected
AI discovers PHP vulnerability that lay dormant for over a decade; NSA advises taking systems offline if they cannot be updated
OpenAI and Google-owned Wiz disclosed that researchers used AI to discover a severe security vulnerability in the PHP core engine, involving memory leaks and unauthenticated remote code execution, with a maximum severity score of 9.2 and affected versions dating back to PHP 5.4. The NSA has issued an emergency advisory requiring relevant organizations to update as soon as possible, and advising that systems be temporarily taken offline if they cannot be updated immediately. The PHP Foundation has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix the vulnerability. The Wiz research used the Wiz Atlas security agent, Gemini 4 Argon, and GPT-5.6 Sol.
Jiwei.com
PHP Exposed to Severe Security Vulnerabilities, Websites of Institutions in Multiple Countries Temporarily Taken Offline
The UK National Cyber Security Centre issued an alert stating that the PHP scripting language, widely used in website development, has two severe security vulnerabilities; attackers can trigger memory exhaustion to cause memory corruption and, under specific conditions, remotely execute code. The PHP development team released an emergency security update on the 21st to fix the vulnerabilities. The UK Office for Budget Responsibility, Finland's government public network services, and the Netherlands' cybersecurity agency, among others, temporarily took their websites offline out of security concerns. Cloud service vendors such as Tencent Cloud and Alibaba Cloud have issued vulnerability notices, reminding users to investigate and update as soon as possible or take mitigation measures; BBC reported that these vulnerabilities were discovered by researchers at cybersecurity firms with the help of artificial intelligence tools, and had existed for more than a decade without being detected.
Deutsche Welle ChineseSelected
AI discovers major PHP vulnerability; multiple governments and enterprises suspend online services
The PHP development team released an emergency security update on October 21, fixing a severe vulnerability present in all versions of PHP over the past 20 years. Cybersecurity firms say some hackers have already begun exploiting the vulnerability to launch attacks. Censys data shows that of the 2.6 million hosts reported to be running PHP, about 1.5 million are still using versions with no fix available; Nomura Securities, Mitsubishi UFJ, All Nippon Airways, and East Japan Railway in Japan, as well as the Dutch government portal, the Port of Rotterdam, and some Wikipedia systems, have suspended related online services. Wiz says it discovered these vulnerabilities using its autonomous vulnerability research tools Wiz Atlas and Gemini 4 Argon and GPT-5.6 Sol, while Calif says it discovered the vulnerability on August 1 with the help of a large language model.
cnBetaSelected
Amazon warns that a new PHP vulnerability discovered by AI is being exploited at scale
Amazon said that two PHP security vulnerabilities discovered by researchers using OpenAI and Google AI models had already been attempted to be exploited by hackers four days before public disclosure, and are now being widely exploited. The NSA and the UK NCSC warned organizations using PHP to update their systems immediately, or otherwise take them offline temporarily; the PHP maintainers have released a fix update, and Wiz estimates that PHP underpins about 70% of websites worldwide. OpenAI said this is a case of frontier AI models discovering vulnerabilities before attackers, but the same capability could also help attackers develop exploit programs.
CTech
AI discovers a PHP vulnerability over a decade old; government websites in multiple European countries urgently suspend services
Two cybersecurity companies used AI to discover a critical vulnerability in PHP that had been hidden for over a decade, and government agencies and organizations in multiple European countries suspended online services on Wednesday. Censys identified about 2.6 million hosts using PHP, of which about 1.5 million run versions with no fix available; Wiz said it completed the discovery using Wiz Atlas with Gemini 4 Argon and GPT-5.6 Sol, while Calif said it discovered the vulnerability on August 1 with the help of a large language model. Amazon security chief CJ Moses said its honeypot system had detected exploitation attempts four days before public disclosure.
Rohan PaulSelected
NSA warns of PHP core vulnerabilities PHP2Shell, says discovered with assistance from GPT-5.6 Sol
The NSA requires organizations to fix two PHP core vulnerabilities named PHP2Shell, or take unpatched servers offline; California researchers are said to have discovered these vulnerabilities with the help of OpenAI's GPT-5.6 Sol. Both vulnerabilities are in the PHP core, affecting any installation that handles web requests; on Apache's mod_php, demonstrated attacks trigger memory corruption before application code executes, and login and application-layer checks cannot block them. Cloudflare observed attacks before PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, and VirusTotal counts about 5.1 million IPs running PHP, of which about 758,000 run branches that are no longer maintained and have no patched version.
BBC TechnologySelected
AI discovers years-old PHP vulnerabilities, institutions in multiple countries worldwide urgently take websites offline
Researchers from security companies Calif and Wiz, using OpenAI technology, discovered vulnerabilities in PHP that could allow attackers to take over servers and steal data without authentication; Wiz called it the most severe vulnerability detected by AI. PHP developers have released patches and urged all users to update immediately; the US NSA advised organizations unable to patch immediately to take systems offline, and the Finnish government, Edinburgh Council, the BBC, the Dutch cybersecurity agency, and multiple Scottish public institutions have taken their websites offline. OpenAI called the discovery one of the most impactful security issues recently and released a program to check whether PHP platforms are secure.
Yicai
Two critical vulnerabilities found in PHP; government websites in the Netherlands, Denmark, Finland, France and other countries taken offline as an emergency measure
PHP developers discovered two critical vulnerabilities and urged users to update as soon as patches are released; government websites in many parts of the world were taken offline on Wednesday as a precaution. The Port of Rotterdam in the Netherlands, the government portal Overheid.nl, the national football association KNVB, and the websites of five major political parties were taken offline; Denmark's Kombit shut down services including the national school communication platform; Finland's state-owned IT service provider Valtori took government public network services offline; and France's Ministry of the Interior temporarily shut down local government administrative websites. According to W3Techs data, PHP runs about 75% of websites whose programming language can be identified; security experts warn that the surge in AI-assisted hacking activity could amplify this threat, and Cloudflare said it is updating firewall rules as an interim measure.
CNBC Technology
Critical PHP Vulnerability PHP2Shell Triggers Global Alert, Google, OpenAI and Amazon Join Response
Two critical vulnerabilities collectively known as PHP2Shell have been discovered in PHP software, allowing attackers to remotely execute malicious code. The U.S. NSA, FBI, and cybersecurity agencies in Singapore, the U.K., Australia, Canada, and the EU have successively issued warnings. Google said its security unit Wiz used AI models to assist in discovering and investigating the vulnerabilities, with Gemini participating in assessing the vulnerabilities, testing attacks, and verifying patches; OpenAI said its model researchers also helped discover critical PHP vulnerabilities, and said that over the past two months it led coordination among software maintainers, security researchers, and security vendors to prepare fixes. Amazon said its MadPot threat detection system had already detected exploitation attempts before the vulnerabilities were publicly disclosed, while Cloudflare deployed protections through its Web Application Firewall.
Wallstreetcn
AI tools discover severe PHP vulnerabilities that lay dormant for over a decade, threatening about 75% of websites worldwide
The U.S. National Security Agency issued an urgent warning on Wednesday that researchers using AI tools had discovered two severe security vulnerabilities in PHP, and the PHP development team released emergency patches the same day and urged users to update immediately. Wiz Atlas, the AI vulnerability research tool from Google-owned Wiz, combining Gemini 4 Argon and OpenAI's GPT-5.6 Sol, was the first to discover the flaws, and another security firm, Calif, said it independently discovered the same vulnerability on August 1 using a large language model. According to Censys data, of about 2.6 million hosts running PHP, roughly 1.5 million are using versions for which no patch is yet available, and government websites in the Netherlands, France, Denmark, Finland and other countries have been taken offline as a precaution.
TechCrunch AI
Government websites worldwide go offline due to a PHP vulnerability, while Node.js, LiteLLM and others disclose security issues on the same day
After AI discovered a critical security vulnerability in PHP, government websites in many countries around the world went offline, and the U.S. National Security Agency recommended that organizations using PHP update immediately or temporarily take their systems offline. On the same day, Node.js fixed four high-severity vulnerabilities, one of which allows remote code execution; the open-source LLM request proxy LiteLLM was hit by attackers who injected malicious code, and the malicious versions were published to PyPI, Docker Hub and GHCR, containing an information stealer that harvests cloud credentials, passwords and AI service credentials as well as a remote access trojan. LiteLLM said it has removed the malicious versions and images. In addition, the private key of the Indian certificate authority eMudhra was compromised, and security professionals say the cleanup effort will be larger than that of Heartbleed.
CNN Business Tech
AI-assisted discovery of critical PHP vulnerability PHP2Shell prompts emergency takedowns and patching of numerous websites worldwide
Teams from OpenAI, Wiz, and Calif used AI to discover two long-standing critical vulnerabilities in PHP, collectively called PHP2Shell, which could allow attackers to execute code remotely and read memory containing sensitive information such as passwords. PHP underpins 70% of websites worldwide, and the PHP Foundation has released patches; the U.S. NSA and European cybersecurity agencies advised enterprises to act immediately, while websites of Ireland's The Journal, Japan's ANA, JR West, MUFG, and government sites in France, Denmark, Finland, and the Netherlands were temporarily taken offline. Wiz said researchers used Google's Gemini 4 Argon, Wiz Atlas, and OpenAI's GPT-5.6 Sol, with a single researcher completing in one week work that previously took world-class teams months, and compared the incident to 2014's Heartbleed.
Heat trend for this story
- Current
- 10
- Period peak
- 62 Oct 23 01:00
- 24-hour change
- -45%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.