Governments and corporations rush to patch an AI-discovered PHP flaw after an FBI warning
Summary
The FBI's cyber division warned on Wednesday 21 October about the discovery of two 'critical vulnerabilities' in PHP, a widely used programming language that powers many websites and web applications, The Philadelphia Inquirer and the LA Times reported, some websites going dark as operators addressed the AI-detected flaw. That day The Verge reported that security patches for PHP were expected to roll out to fix the two critical vulnerabilities, The Philadelphia Inquirer that websites were scrambling to fix the flaw, an issue called php2shell that concerns technology that handles website memory when processing queries from a computer, Fortune that OpenAI's GPT-5.6 Sol model played a key role in identifying the issue, and Engadget that government websites in the EU and Canada had been taken offline. On Thursday 22 October, The Philadelphia Inquirer and PBS NewsHour reported that governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally, The Philadelphia Inquirer adding that the flaw could allow hackers to remotely execute code. The Verge reported that hackers attempted to exploit the PHP flaws days before they were patched, according to a report from Amazon Threat Intelligence, Amazon's security team having found a PHP2Shell exploit attempt on October 17th.
Latest: Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally, The Philadelphia Inquirer and PBS NewsHour reported, The Philadelphia Inquirer adding that the flaw could allow hackers to remotely execute code, and The Verge that hackers attempted to exploit the flaws days before they were patched, according to Amazon Threat Intelligence.
Written automatically by an AI from the articles' headlines and descriptions. It can contain errors: follow the links to read the articles.
How it unfolded
Thursday 22 October
Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally, The Philadelphia Inquirer and PBS NewsHour reported, The Philadelphia Inquirer adding that the flaw could allow hackers to remotely execute code, and The Verge that hackers attempted to exploit the flaws days before they were patched, according to Amazon Threat Intelligence.
- 12:49The VergeThe disastrous PHP vulnerabilities were exploited days before the patch
- 12:27The Philadelphia InquirerRush is on to patch a software vulnerability that could impact 70% of websites worldwide
- 09:29The Philadelphia InquirerRush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide
- 08:51PBS NewsHourAI discovered a software vulnerability that could impact 70% of websites worldwide. The rush is on to patch it
Wednesday 21 October
The FBI's cyber division warned about the discovery of two 'critical vulnerabilities' in PHP, a widely used programming language that powers many websites, and some websites went dark as operators addressed the AI-detected flaw, The Philadelphia Inquirer and the LA Times reported, Engadget saying government websites in the EU and Canada had been taken offline.
- 16:56EngadgetGovernment websites in the EU and Canada taken offline over PHP vulnerability
- 16:27The Philadelphia InquirerWebsites scramble to fix software flaw that could put much of internet at risk
- 16:08LA TimesSome websites go dark as operators address an AI-detected flaw in a web programming language
- 14:59FortuneAI tools discovered the PHP vulnerability that could take down 70% of the Internet. Now the race is on to patch it before AI-powered hackers attack
- 13:43The Philadelphia InquirerSome websites go dark as operators address an AI-detected flaw in a web programming language
- 07:53The VergeA critical PHP vulnerability may take websites down today