All timelines
TechnologyUnited States

Governments and corporations rush to patch an AI-discovered PHP flaw after an FBI warning

11 articles from 6 sources
First reported on Wednesday 21 October 2026 at 07:53 EDT by The Verge·Latest article on Thursday 22 October 2026 at 12:54 EDT

Summary

The FBI's cyber division warned on Wednesday 21 October about the discovery of two 'critical vulnerabilities' in PHP, a widely used programming language that powers many websites and web applications, The Philadelphia Inquirer and the LA Times reported, some websites going dark as operators addressed the AI-detected flaw. That day The Verge reported that security patches for PHP were expected to roll out to fix the two critical vulnerabilities, The Philadelphia Inquirer that websites were scrambling to fix the flaw, an issue called php2shell that concerns technology that handles website memory when processing queries from a computer, Fortune that OpenAI's GPT-5.6 Sol model played a key role in identifying the issue, and Engadget that government websites in the EU and Canada had been taken offline. On Thursday 22 October, The Philadelphia Inquirer and PBS NewsHour reported that governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally, The Philadelphia Inquirer adding that the flaw could allow hackers to remotely execute code. The Verge reported that hackers attempted to exploit the PHP flaws days before they were patched, according to a report from Amazon Threat Intelligence, Amazon's security team having found a PHP2Shell exploit attempt on October 17th.

Latest: Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally, The Philadelphia Inquirer and PBS NewsHour reported, The Philadelphia Inquirer adding that the flaw could allow hackers to remotely execute code, and The Verge that hackers attempted to exploit the flaws days before they were patched, according to Amazon Threat Intelligence.

Written automatically by an AI from the articles' headlines and descriptions. It can contain errors: follow the links to read the articles.

How it unfolded

  1. Thursday 22 October

    Governments and corporations worked throughout the night to update software after the AI-assisted discovery of vulnerabilities in a programming language vital to about 70% of websites globally, The Philadelphia Inquirer and PBS NewsHour reported, The Philadelphia Inquirer adding that the flaw could allow hackers to remotely execute code, and The Verge that hackers attempted to exploit the flaws days before they were patched, according to Amazon Threat Intelligence.

  2. Wednesday 21 October

    The FBI's cyber division warned about the discovery of two 'critical vulnerabilities' in PHP, a widely used programming language that powers many websites, and some websites went dark as operators addressed the AI-detected flaw, The Philadelphia Inquirer and the LA Times reported, Engadget saying government websites in the EU and Canada had been taken offline.