{
  "id": 15937333,
  "title": "AI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack",
  "url": "https://urgent.news/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-21T18:48:38.000Z",
  "source": {
    "name": "Fortune",
    "slug": "fortune",
    "url": "https://fortune.com/2026/10/21/ai-tools-discovered-the-php-vulnerability-that-could-take-down-70-of-the-internet-now-the-race-is-on-to-patch-it-before-ai-powered-hackers-attack/"
  },
  "original_language": "en",
  "account": "Powerful AI tools are at the forefront of a security battle, with defenders using them to identify critical issues that could take down significant portions of the internet if left unaddressed. Today, the focus is on a pair of \"critical\" software vulnerabilities discovered in the open-source programming language PHP, which is used by most web pages. The PHP Foundation disclosed these vulnerabilities and released an emergency patch, urging website owners to implement it immediately or shut down their sites until they're patched. One of the vulnerabilities, CVE-2026-109618, has been exploited by opportunistic attackers who managed to steal source code, expose cookie data, and leak legal documents. Government agencies have advised potentially affected organizations to update their services, including the FBI's Cyber Division, the NSA, and the Prime Minister of Japan's office. The PHP Foundation, OpenAI, and California-based AI red-teaming firm Calif collaborated to identify and patch the vulnerabilities, which were found using AI models to autonomously run attack sequences. The impact of these flaws is massive, as they allow bad actors to remotely execute code on flawed systems, potentially causing significant damage.",
  "summary": "OpenAI's GPT-5.6 Sol model played a key role in identifying the issue",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}