{
  "id": 15938733,
  "title": "Critical PHP Flaws Threaten Millions of Websites in New AI Security Test",
  "url": "https://urgent.news/2026/10/21/critical-php-flaws-threaten-millions-of-websites-in-new-ai-security",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-21T19:03:58.000Z",
  "source": {
    "name": "Newsweek",
    "slug": "newsweek",
    "url": "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225"
  },
  "original_language": "en",
  "account": "Two critical security flaws have been discovered in PHP, a technology powering a significant portion of the internet, potentially putting millions of websites and the data they store at risk. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry a critical severity rating and have been dubbed \"PHP2Shell\". According to the United States National Security Agency Cybersecurity Division, PHP is used in roughly 70 percent of websites worldwide, though not all are vulnerable to these specific attacks. Wiz Research, which discovered the flaws with the help of AI models, recommends updating PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. AI, particularly Google Cloud's Gemini 4 Argon, played a significant role in identifying and addressing these vulnerabilities. The flaws could allow attackers to execute code or access sensitive information, affecting major platforms like WordPress, Drupal, Joomla, Magento, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony, and WHMCS. Some organizations have taken their websites offline while they install security updates. While the vulnerabilities primarily affect websites and servers, they are not directly patchable by ordinary internet users. However, site owners are advised to update to a PHP release containing the patch to mitigate the risk.",
  "summary": "Some organizations have temporarily taken websites and online services offline rather than leave vulnerable systems exposed.",
  "key_points": [],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/15938733.png",
  "coverage": {
    "outlets": 4,
    "also_reported_by": [
      {
        "outlet": "The Korea Times",
        "title": "Websites go dark worldwide as AI exposes critical security flaws",
        "url": "https://urgent.news/2026/10/21/websites-go-dark-worldwide-as-ai-exposes-critical-security-flaws",
        "published": "2026-10-21T16:57:03.000Z"
      },
      {
        "outlet": "Business Recorder",
        "title": "Websites go dark worldwide as AI exposes critical security flaws",
        "url": "https://urgent.news/2026/10/21/websites-go-dark-worldwide-as-ai-exposes-critical-security-flaws-15918979",
        "published": "2026-10-21T16:59:55.000Z"
      },
      {
        "outlet": "Le Monde English",
        "title": "Websites worldwide go dark as AI exposes security flaws",
        "url": "https://urgent.news/2026/10/21/websites-worldwide-go-dark-as-ai-exposes-security-flaws",
        "published": "2026-10-21T17:07:54.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}