AI Helped Find a Critical Bug Affecting Huge Swathes of the Internet
Researchers utilizing advanced artificial intelligence models identified critical security vulnerabilities in PHP, a foundational open-source programming language used by numerous global websites including many government portals. The flaws, which had been known theoretically for decades but previously deemed too complex to exploit, allowed attackers to potentially seize control of web servers and steal data if left unpatched. Following the coordinated disclosure, cybersecurity teams worldwide rushed to deploy fixes, resulting in temporary outages for various European and Canadian government sites. OpenAI described the incident as one of the most impactful security issues in recent memory, noting that their models have already uncovered additional significant vulnerabilities. Data from Epoch AI indicates a sharp rise in reported critical vulnerabilities, increasing from roughly two dozen per month historically to around 600 currently. Greg Brockman, President of OpenAI, argued that current manual patching processes are insufficient for this accelerating threat landscape and suggested governments may need to assume a larger role in directly securing internet infrastructure.
Two critical vulnerabilities in PHP, the server-side programming language powering approximately 70 percent of the world’s websites, triggered a global cybersecurity emergency on Wednesday. Government agencies, including the U.S. National Security Agency and European counterparts, issued urgent warnings urging organizations to install immediate patches or take their websites offline. The flaws, which allow attackers to gain unauthorized control of web servers without valid credentials, were identified primarily through the use of artificial intelligence models. The discovery marks a pivotal moment in cybersecurity, demonstrating that AI can uncover deep-seated code defects that evaded human detection for decades. The vulnerabilities, dubbed "php2shell" by security firms, exist in all versions of PHP since version 5, which was released in 2004. They stem from errors in memory management that permit remote code execution or the leakage of sensitive data stored in server memory. Because PHP underpins major content management systems like WordPress and numerous government and commercial sites, the potential impact is vast. The NSA stated that the flaws often provide direct access to a server’s file system or database. In response, dozens of websites across the United States, United Kingdom, and elsewhere were temporarily removed from the internet while administrators applied fixes. Parts of Wikipedia and the image board 4chan were among the services taken offline as a precaution. The identification of these bugs resulted from a convergence of traditional security auditing and advanced AI capabilities. On July 30, researchers at the security firm Calif, participating in OpenAI’s "Patch the Planet" initiative, directed the GPT-5.6 Sol model to analyze PHP code. By August 1, the AI identified a viable exploitation path for a long-standing weakness. Shortly thereafter, Wiz, a security company owned by Google, independently discovered additional exploits using its own AI agent, Wiz Atlas, alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Both firms followed responsible disclosure protocols, sharing their findings with the PHP Foundation to develop a fix before making the information public. The timeline of the crisis accelerated dramatically in late October. Details regarding the vulnerabilities began circulating online two days before the scheduled patch release, prompting PHP maintainers to move the update forward by one day. The patch was officially released on October 21, 2026. However, prior to the official announcement, Calif inadvertently published a video demonstrating the exploit. This leak triggered a surge in malicious activity. Cloudflare recorded thousands of attempted intrusions before the public alert, rising to tens of thousands within 45 minutes of the announcement and reaching millions within two hours. Historical records show that the underlying class of bug was first described by security researcher Stefan Esser in 2004. Despite this early warning, the flaw remained largely dormant because exploiting it required an exceptionally complex chain of manual steps that were impractical for human attackers. A 2024 security audit by the PHP Foundation had theoretically identified the issue but deprioritized it in favor of other concerns. AI changed this dynamic by automating the intricate logic required to turn a theoretical vulnerability into a functional attack. Volker Dusch, a security engineer at the PHP Foundation, compared the severity of the incident to the Heartbleed bug of 2014, describing it as the most serious problem facing PHP in over a decade. The incident has sparked debate regarding the future of internet security. OpenAI characterized the discovery as one of the most impactful security issues in recent memory, noting that frontier AI found the vulnerabilities before attackers did. Greg Brockman, president of OpenAI, warned that the current manual process for creating fixes is unsustainable as AI-driven discoveries become more frequent. He suggested that governments may need to assume a larger role in monitoring and securing critical infrastructure. Conversely, Sagi Tzadik, a security researcher at Wiz, expressed optimism, stating that the ability to fix vulnerabilities at an unprecedented rate is ultimately beneficial for security. Despite the successful patch deployment, concerns remain about the broader implications. The number of significant vulnerabilities reported monthly by major tech providers has risen from a few dozen to approximately 600 in recent times. Experts warn that the gap between a vulnerability being discovered and it being exploited is shrinking rapidly. While defenders currently benefit from early access to advanced AI models, the eventual availability of similar capabilities to malicious actors poses a persistent threat. The PHP Foundation emphasized that updating to the latest version of PHP, currently 8.5.12, is imperative for all users, as older versions are no longer supported. The coordinated effort to resolve the crisis involved roughly 15 researchers from competing companies who collaborated without formal contracts, relying on mutual trust to trace the vulnerabilities to their common source and validate the fix.
Go to the primary sources (6)
The official sources this coverage is built on. Read them directly to bypass framing.
Security authorities in multiple countries, including the United States and Japan, issued urgent warnings regarding two critical vulnerabilities in the PHP programming language, which powers approximately 70 percent of global websites. These flaws, identified with the assistance of an OpenAI artificial intelligence model, allow unauthorized actors to gain control of web servers without requiring standard login credentials. The discovery has prompted immediate defensive actions, such as temporary service suspensions by platforms like Wikipedia and 4chan, while developers work to deploy necessary patches. Experts note that although the bugs existed for decades, exploiting them previously required a highly complex sequence of steps that human researchers had overlooked. This incident marks a significant shift in cybersecurity dynamics, demonstrating that AI can identify high-impact flaws at a scale and speed that challenges traditional defense timelines.
Bias read (Center): The article focuses primarily on technical cybersecurity developments and industry responses rather than partisan politics. While it mentions government officials issuing warnings, this is presented as a standard administrative response to a national security threat rather than a point of political,
Why factuality (95): Accurately reflects the primary source regarding the 70% usage statistic, the involvement of OpenAI, the nature of the vulnerabilities (unauthenticated RCE/memory disclosure), and the global response. Minor imprecision in stating 'two' vulnerabilities when the source mentions 'multiple' grouped unde
Why objectivity (90): Maintains a professional, journalistic tone. Uses standard news framing ('alarm', 'stakes') appropriate for a major security breach without resorting to sensationalism or bias.
Researchers utilizing advanced artificial intelligence models identified critical security vulnerabilities in PHP, a foundational open-source programming language used by numerous global websites including many government portals. The flaws, which had been known theoretically for decades but previously deemed too complex to exploit, allowed attackers to potentially seize control of web servers and steal data if left unpatched. Following the coordinated disclosure, cybersecurity teams worldwide rushed to deploy fixes, resulting in temporary outages for various European and Canadian government sites. OpenAI described the incident as one of the most impactful security issues in recent memory, noting that their models have already uncovered additional significant vulnerabilities. Data from Epoch AI indicates a sharp rise in reported critical vulnerabilities, increasing from roughly two dozen per month historically to around 600 currently. Greg Brockman, President of OpenAI, argued that current manual patching processes are insufficient for this accelerating threat landscape and suggested governments may need to assume a larger role in directly securing internet infrastructure.
Bias read (Center): The article focuses primarily on technical developments in cybersecurity and the capabilities of AI tools rather than partisan politics. While it mentions potential implications for government roles in infrastructure security, the tone remains factual and balanced, citing multiple independent and on
Why factuality (85): Mostly accurate regarding the scope and impact. However, it introduces external sourcing (WSJ, Epoch AI) and specific dates (August/July) not present in the primary document, creating a slight risk of conflation between the discovery timeline and the disclosure date (Oct 21, 2026).
Why objectivity (80): Slightly less objective due to the inclusion of a promotional call-to-action ('Sign up...') and slightly more interpretive language ('scrambling', 'broad swathes'), though still within acceptable journalistic bounds.
The U.S. National Security Agency issued a warning regarding two critical vulnerabilities discovered in the PHP programming language, which powers approximately 70% of websites globally. These flaws, present in PHP versions dating back to 2004, allow attackers to access server file systems or databases, prompting the NSA to advise taking affected sites offline if immediate patching is impossible. The vulnerabilities were identified through artificial intelligence tools, specifically by OpenAI using GPT-5.6 Sol and Google’s Wiz using its own AI agents, under coordinated disclosure protocols. While no active exploitation in the wild has been reported, experts note that AI lowers the technical barrier for creating exploits, increasing the urgency for widespread updates to the latest PHP version, 8.5.12. Major technology firms and hosting providers are collaborating to assist in patching, while WordPress clarified that the issue stems from the underlying PHP environment rather than the CMS itself.
Bias read (Center): The article covers a cybersecurity incident involving major tech corporations and a government agency. The tone is informative and urgent but remains fact-based, citing official warnings and technical details without injecting partisan political commentary or ideological framing. The mention of the
Why factuality (80): Contains potential inaccuracies regarding specific version numbers (claiming PHP 8.5.12 is current vs source implying 8.x series generally) and specific tool names (GPT-5.6 Sol, Gemini 4 Argon) which are not verified in the primary text. The claim that flaws exist in 'all versions since 5' is a simp
Why objectivity (75): Uses sensationalist headline ('Armageddon') and emotive language ('panicking', 'alarming'). While the facts are mostly there, the tone leans toward hype rather than dispassionate reporting.
Security researchers at Wiz and Calif discovered a critical vulnerability in PHP, the programming language underlying approximately 70% of the web, using artificial intelligence agents. The flaw, which had remained undetected for over a decade, was identified during an attempt to test if a known WordPress bug applied to Drupal. Although the discovery initially raised fears of an imminent 'cyber-apocalypse,' the coordinated efforts of multiple cybersecurity firms allowed for a rapid patch development process. However, the timeline nearly resulted in widespread compromise when information about the exploit leaked prior to the patch release, leading to millions of attack attempts and the temporary takedown of numerous high-profile websites, including government sites and portions of Wikipedia. The incident highlights a shifting dynamic in cybersecurity where AI accelerates both the discovery of vulnerabilities and the speed required for remediation.
Bias read (Center): The article focuses primarily on technical developments in cybersecurity and the operational challenges faced by developers and security firms. While the mention of government websites being taken down introduces a minor element of public infrastructure impact, the core narrative remains centered on
A recent security crisis involving PHP, a widely used programming language, has exposed significant vulnerabilities across the internet. OpenAI models assisted in identifying these bugs, which allow for powerful exploits, though the flaws had existed for over a decade. The article attributes the severity of the incident primarily to human complacency rather than artificial intelligence itself, noting that previous audits by the PHP Foundation identified similar risks but prioritized other issues. This event highlights how AI can amplify existing systemic weaknesses in digital infrastructure, such as outdated codebases. While the immediate impact remains uncertain, the situation serves as a warning about the need for proactive maintenance of global software foundations. The piece argues that while AI cannot solve societal or technical neglect on its own, it provides tools to identify these gaps, necessitating robust policy responses and resource allocation to prevent future catastrophes.
Bias read (Center): The article discusses a technological security issue with clear policy implications regarding infrastructure maintenance and regulatory oversight. However, the framing is balanced and analytical, focusing on systemic failures ('human complacency') rather than partisan politics. It does not advocate,
A significant cybersecurity incident, referred to as 'Black October,' emerged after artificial intelligence tools developed by OpenAI identified two critical vulnerabilities in the PHP programming language. These flaws, which had remained undetected for over a decade due to the complexity of the exploitation techniques, allowed attackers to potentially seize control of web servers and steal sensitive user data such as passwords. In response to the threat, dozens of websites across the United States, the United Kingdom, and other regions temporarily took their services offline to apply security patches released on October 21, 2026. Major cybersecurity agencies, including the National Security Agency and Europe’s cybersecurity body, issued alerts urging immediate action, with the NSA specifically advising operators to take sites offline if patching could not be completed quickly. The event highlights the growing role of frontier AI in uncovering deep-seated software defects before malicious actors can exploit them, marking a shift in how digital infrastructure security is managed.
Bias read (Center): The article focuses primarily on a technical cybersecurity issue involving software vulnerabilities and the capabilities of AI in discovering them. While it mentions government agencies like the NSA issuing warnings, the core subject matter is technological infrastructure and corporate security, not
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
United States
