Hackers attack Websites are taken away The race for PHP updates is paralyzing the Internet
Two critical security vulnerabilities identified in PHP, designated CVE-2026-109618 and CVE-2026-109619, allow remote attackers to execute arbitrary code on vulnerable servers without prior authentication. The PHP development team rates both flaws at 9.2 out of 10 points, noting that systems using the Apache extension mod_php are particularly at risk due to known attack vectors. In response to the threat, numerous website operators, including the University of Vienna, TU Wien, and Austrian news outlets, temporarily took their sites offline while awaiting patches. Security authorities advised disconnecting affected systems from the public internet if immediate updates were not feasible. Fixed versions of PHP, including 8.5.12, 8.4.27, 8.3.36, and 8.2.35, have been released, and users of unsupported older versions are urged to upgrade. The vulnerabilities were discovered by the security firm Wiz using artificial intelligence, and early reports indicate that hackers have already attempted to exploit these weaknesses.
Two critical security vulnerabilities in the widely used server-side scripting language PHP have forced millions of websites globally to go offline or issue urgent alerts for immediate patching. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to execute arbitrary code on vulnerable servers remotely without requiring prior authentication. Security experts rate both bugs with a severity score of 9.2 out of 10, describing them as posing an exceptional threat potential. The vulnerabilities affect nearly all currently supported versions of PHP, reaching back to version 5.4, which was released more than a decade ago. This extensive range leaves older, unpatched servers and specialized devices, such as network-attached storage units, particularly exposed. The incident unfolded rapidly on Wednesday, October 21, 2026. Prior to the official release of fixes, news of the leaks spread, prompting a wave of precautionary shutdowns across Europe and Asia. In Austria, the University of Vienna, the Technical University of Vienna, the Lower Austrian Newspaper (NÖN), the Austrian Press Agency’s distribution service, the Austrian Road Vehicle Administration Authority, and the Caritas organization temporarily removed their digital services from the internet. German authorities reacted similarly, with the cities of Mainz, Potsdam, and Halberstadt shutting down municipal portals. The Charité university hospital in Berlin, the transport company Üstra in Hanover, and several state constitutional protection agencies in Bavaria, Hesse, and Thuringia also went offline. The German Federal Office for Information Security classified the risk level as three, orange, indicating that immediate countermeasures were necessary to prevent severe disruption to regular operations. Similar defensive actions occurred internationally. In France, the website of the Paris Police Prefecture was taken down following the detection of the critical vulnerability. In the Netherlands, the national cyber security center, the Port of Rotterdam, and the national football association suspended their web presences. Authorities in Denmark, Finland, Japan, and Australia also issued warnings and took government websites offline. The Wikimedia Foundation, operator of Wikipedia, stated it had taken down several systems as a precaution until safe patches could be applied. These widespread takedowns created a visible gap in internet availability, affecting everything from simple blogs to complex e-commerce platforms and content management systems like WordPress, which powers an estimated 400 million to 500 million websites globally. The vulnerabilities were discovered in mid-August 2026 by two independent security firms, Wiz and Calif. Both organizations utilized artificial intelligence tools to identify the flaws. Wiz specifically cited the use of OpenAI’s GPT-5.6 Sol model, alongside its own cybersecurity solution, Wiz Atlas, and Google’s Gemini 4 Argon. Calif reported detecting the first issue on August 1, 2026. The discovery process highlighted how AI tools are accelerating the identification of complex software defects, creating time pressure on developers to produce and distribute fixes quickly. The vulnerabilities were named PHP2Shell because they grant attackers shell access to compromised servers, effectively allowing them to take full control of the system. Security researchers noted that the risk is highest for systems running PHP with the Apache extension mod_php enabled. For this specific configuration, a functional attack path exists that allows exploitation before application code is even executed. A video circulating before the official disclosure demonstrated how the vulnerabilities could be used to compromise popular software stacks, including WordPress, MediaWiki, Drupal, and phpBB. Once inside a server, attackers can steal sensitive customer data, disrupt payment processing, deface websites, or use the compromised machines as launch points for further attacks against other networks. The PHP development team released emergency security updates at 16:00 Central European Time on Wednesday. The fixed versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The foundation urged all users to update immediately, stating that temporary configuration changes might limit known attack paths but do not replace the need for the actual patch. Organizations using unsupported versions of PHP were advised to migrate to current, supported releases. While some operators installed the updates within hours, others faced challenges due to legacy hardware or complex server environments. Evidence suggests that exploitation began almost immediately after the information became public. Dane Knecht, chief technology officer at security firm Cloudflare, reported observing early attacks emerging in the hours leading up to the official patch release. His team updated mitigation strategies as new attack vectors appeared. Another security firm, sansec, claimed that mass attacks started just 15 minutes after the initial publication of the vulnerability details. The rapid response from defenders and attackers alike illustrates the high stakes involved in securing foundational internet technologies. As of late Wednesday, many affected institutions remained offline while administrators verified their systems and deployed the latest security patches.
Go to the primary sources (4)
The official sources this coverage is built on. Read them directly to bypass framing.
Two critical security vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been disclosed in the PHP software, allowing attackers to take over servers running unpatched versions. The flaws affect nearly all currently used PHP versions, including legacy releases dating back to PHP 5.4, and pose a severe risk to systems using the mod_php module where functional exploits already exist. Prior to the official release of patches, many organizations, including Austrian universities, the Caritas, and various hosting providers, voluntarily took their websites offline to prevent potential breaches. The vulnerabilities were discovered by the cybersecurity firm Wiz using artificial intelligence tools, specifically OpenAI’s GPT-5.6 Sol model, alongside other AI-driven detection methods. With a high severity rating of 9.2 on the CVSS scale, system administrators are urged to apply updates immediately to secure their infrastructure against widespread exploitation.
Bias read (Center): The article reports on a technical cybersecurity incident involving software vulnerabilities. While the impact is significant for web infrastructure, the subject matter is apolitical, focusing on IT maintenance, security protocols, and technological discovery rather than political debate or policy.
Why factuality (85): Accurately identifies the CVEs, the specific risk associated with mod_php, and the pre-publication takedown of sites like universities and media outlets. It correctly cites Ars Technica regarding the circulating exploit video. The text cuts off before providing the specific CVSS score mentioned in t
Why objectivity (70): Uses somewhat dramatic language ('middle security panic', 'extremely dangerous') and focuses heavily on the chaos aspect rather than just the technical details. However, it remains largely informative and does not engage in excessive sensationalism beyond what is typical for breaking tech news.
HeuteIndependentCenterFactual 60Objective 4015 hr. ago
Two critical security vulnerabilities identified in PHP, designated CVE-2026-109618 and CVE-2026-109619, allow remote attackers to execute arbitrary code on vulnerable servers without prior authentication. The PHP development team rates both flaws at 9.2 out of 10 points, noting that systems using the Apache extension mod_php are particularly at risk due to known attack vectors. In response to the threat, numerous website operators, including the University of Vienna, TU Wien, and Austrian news outlets, temporarily took their sites offline while awaiting patches. Security authorities advised disconnecting affected systems from the public internet if immediate updates were not feasible. Fixed versions of PHP, including 8.5.12, 8.4.27, 8.3.36, and 8.2.35, have been released, and users of unsupported older versions are urged to upgrade. The vulnerabilities were discovered by the security firm Wiz using artificial intelligence, and early reports indicate that hackers have already attempted to exploit these weaknesses.
Bias read (Center): The article covers a cybersecurity incident involving software vulnerabilities and patch management. While it mentions specific institutions like universities and news agencies taking action, the core subject is technical infrastructure and digital security rather than political policy, governance,或
Why factuality (60): Contains significant factual errors and exaggerations. Claims the risk level is '10 out of 10' (primary source implies high/critical but doesn't explicitly state a perfect 10/10 CVSS in the snippet, though often critical vulns are near this, the phrasing is hyperbolic). More critically, it states 'a
Why objectivity (40): Highly sensationalized tone ('Super-GAU', 'Mega-Shock', 'shocked students'). Uses emotional language to frame the event as a catastrophic internet failure rather than a serious security incident requiring patching. The framing is biased towards creating alarm rather than informing calmly.
Kleine ZeitungParty-alignedCenterFactual: no official source document/info detectedObjective 8511 hr. ago
Two critical vulnerabilities in the widely used programming language PHP allow attackers to execute malicious code on foreign servers. The security flaws have already caused numerous websites in Austria and Germany to go offline. Security updates addressing these issues are now available for users to implement.
Bias read (Center): The article reports on a technical cybersecurity issue involving software vulnerabilities. While it mentions specific countries (Austria and Germany), the subject matter is purely technological and apolitical, focusing on IT infrastructure rather than government policy or political actors.
Why factuality: no official source document/info detected
Why objectivity (85): Maintains a professional, journalistic tone. Presents the facts neutrally without injecting fear-mongering or subjective opinion. The structure is clear and balanced, focusing on the threat and the solution.
IT security experts worldwide have issued urgent warnings regarding two critical vulnerabilities identified in the popular web programming language PHP. The flaws, designated CVE-2026-109618 and CVE-2026-109619, carry a maximum risk rating of 10 out of 10 and affect all unpatched versions of PHP 5 and later. Attackers can exploit these gaps to inject malicious code, seize complete control of affected web servers, and steal sensitive customer data. Security firm sansec reported that mass attacks began within 15 minutes of the vulnerability disclosure. In response, numerous institutions including the University of Vienna, TU Wien, the Austrian Federal Police (ÖAMTC), and various other organizations temporarily took their websites offline to prevent exploitation. Emergency security updates were released by the PHP developers on October 21, 2026, prompting immediate action from website operators to patch systems or disconnect them from the internet.
Bias read (Center): The article covers a technical cybersecurity incident involving software vulnerabilities. While it mentions specific institutions like universities and government agencies taking defensive actions, the core subject is a global technology issue rather than a political debate or policy dispute. The ph
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
Austria
