{
  "id": 15907045,
  "title": "PHP Vulnerabilities Could Put Much of the Internet at Risk, Experts Warn",
  "url": "https://urgent.news/2026/10/21/php-vulnerabilities-could-put-much-of-the-internet-at-risk-experts",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T14:36:13.000Z",
  "source": {
    "name": "CNET",
    "slug": "cnet",
    "url": "https://www.cnet.com/tech/services-and-software/php-vulnerabilities-web-hosting-cybersecurity-news/"
  },
  "original_language": "en",
  "account": "Two significant cybersecurity vulnerabilities have been discovered in the PHP programming language, raising concerns for the stability of the internet. The agency monitoring PHP issued a severe warning on Tuesday, stating that the fixes should have been implemented by Wednesday at 10 a.m. ET. However, security experts are urging website administrators to act immediately and take precautions. The severity rating of the warning is exceptionally high, scoring 9.2 out of 10.\n\nPHP is a free, open-source programming language that forms the backbone of much of the web. If exploited, these vulnerabilities could potentially allow hackers to gain access to websites, affecting approximately 70% of the world's websites, according to the Wall Street Journal. Major security agencies, including the US National Security Agency and the UK's National Cyber Security Centre, are advising website administrators to either install the updates or take their sites offline until they can be patched.\n\nCloudflare's chief technology officer, Dane Knecht, confirmed on Wednesday morning that the company had deployed a fix to its firewall. Cybersecurity firm watchTowr was also able to reproduce one of the exploits, stating that AI-powered threat intelligence is already observing the vulnerabilities in action. OpenAI revealed that the PHP vulnerabilities were identified by a self-described hacker team named Calif, utilizing their AI model, GPT-5.6 Sol. Additionally, Wiz, an AI cloud cybersecurity company, independently confirmed the vulnerabilities.\n\nThe rise of AI in cybersecurity presents a dual-edged sword. While AI tools can help defenders uncover security flaws with internet-scale impact, they also provide attackers with powerful means to rapidly develop offensive tools and exploits. OpenAI acknowledged that this incident demonstrates how AI can uncover security flaws on a massive scale but also highlights the potential for attackers to quickly develop offensive tools using the same capabilities. Companies like OpenAI and Anthropic are taking steps to mitigate this risk by releasing their AI models gradually to allow cybersecurity experts to use them first and strengthen their defenses. However, for everyday internet users, the primary concern is that while AI is adept at spotting these bugs, it may take longer to patch them, leaving websites vulnerable to potential attacks.",
  "summary": "Up to 70% of all the websites on the internet could be affected.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}