An agency that monitors the programming language PHP issued a severe warning on Tuesday that it had identified two major cybersecurity vulnerabilities. Fixes should have been deployed on Wednesday at 10 a.m. ET, but security experts are urging website administrators to take immediate notice and precautions.
PHP is a free, open-source programming language that much of the web is built on. The warnings are unusually severe, rated 9.2 out of 10. While we don’t have many details about the specifics of the vulnerabilities yet, the concern is that the exploit could be used by bad actors to hack into websites. The vulnerabilities could affect 70% of the world’s websites, according to the Wall Street Journal. That’s why security agencies around the globe, including the US National Security Agency and the UK’s National Cyber Security Centre, are urging website administrators to install the updates or take their sites offline until they are able to patch them.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or…
— NSA Cyber (@NSACyber) October 21, 2026
Cloudflare’s chief technology officer Dane Knecht said Wednesday morning that the company has deployed a fix to its firewall. Cybersecurity company watchTowr says it was able to successfully reproduce one of the exploits. “As expected, watchTowr Intel is already observing in-the-wild exploitation of the latest PHP vulnerabilities,” Jake Knott, head of threat intelligence, said via email on Wednesday morning. “Whilst nobody has been successful to date, we don’t expect that will last long.”
More from CNET
OpenAI said in a blog post on Wednesday that the vulnerabilities in PHP were discovered by Calif, a self-described hacker team, using its AI model, GPT-5.6 Sol. Wiz, an AI cloud cybersecurity company, also independently identified the vulnerabilities, according to the ChatGPT maker.
Artificial intelligence has been a double-edged sword in cybersecurity, providing both cyber defenders and attackers with powerful tools. And AI companies know this, with OpenAI saying this incident “highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.” Companies like OpenAI and Anthropic have begun slow-rolling the release of their AI models to let cybersecurity experts to use them first to shore up their own defenses and identify any issues before a wider release.
But for everyday internet users like you and me, the concern is that while AI is great at spotting these bugs, it can take longer to get them patched. Even OpenAI says it “expect(s) similar findings to increase sharply in the coming months.”