AI‑found PHP flaw sparks emergency advisories and flood of attacks
Researchers using large language models identified a critical vulnerability in PHP, the language behind roughly 70% of websites. The flaw prompted emergency advisories from cyber agencies in Europe, the United States, the United Kingdom, Australia and Canada, and led many organizations to temporarily take sites offline. Cloudflare detected millions of exploitation attempts shortly after the issue became known, and Amazon’s cloud division said the bug was being widely used.
Chainguard’s Dan Lorenc announced the flaw ahead of an agreed embargo, which the PHP Foundation called a breach of coordinated work. Industry experts warn that AI‑driven discovery is accelerating the exposure of long‑standing software bugs, raising expectations of continued disruptions.
How this was covered
- Right-leaning outlets covered this 87m later
- The two sides describe this in almost entirely different words
- Centrist coverage is the most divided on this story
Why it matters
The vulnerability affects a large share of the web and the surge of attacks could cause widespread site outages.
How this story developed
- Oct 6 AI assistants face website blocks as retailers tighten anti-bot defenses
- Oct 15 OpenAI showcased its Dots agent in a real‑world couch‑shopping test, revealing mixed results.
- Oct 21 PHP maintainers announced they will release emergency updates for two high-severity flaws, each rated 9.2/10, in just over a day.
- Oct 21 EU’s CERT‑EU recommended that organisations unable to patch consider taking vulnerable sites offline.
- Oct 21 AI tools identified two severe remote-code execution bugs in PHP, forcing governments and companies to pull or patch sites as a fix was rushed out.
- Oct 22 German state portals, including Berlin and Hessen, were restored after applying the emergency PHP patches.
- Oct 22 Emergency patches for PHP 8.x have been released as the vulnerability spreads.
- Oct 22 Additional governments—including Denmark, the United Kingdom, Hungary, France, the Netherlands and Finland—temporarily disabled public websites while applying the PHP patches.
- Oct 23 Hong Kong’s Digital Policy Office issued an urgent advisory to patch the PHP vulnerabilities.
- Oct 23 AI-driven analysis has doubled the annual rate of software bug discovery, leading experts to anticipate a hectic period of patches and possible service interruptions. Recent weaknesses in PHP caused site shutdowns across Europe, while additional flaws were found in Node.js, Plex, LiteLLM, Railway, and a weak cryptographic key used by an Indian certificate authority. Industry leaders say AI can locate and weaponize bugs within hours, dramatically shortening defenders’ response time.
- Oct 23 Emergency patches were released for PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Oct 24 Governments and major cloud providers have confirmed that the PHP bug is being widely used in real‑time attacks.
- Oct 26 OpenAI’s Dots service is priced at $100 per month and its demo revealed voice quality issues and misinterpretations.
Related stories
9 in this thread