Attackers could use them to take over web servers without needing a password.<\/p>\n
Volker Dusch, a security engineer at the PHP Foundation, told the Wall Street Journal that it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.<\/p>\n
The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year\u2019s record total.<\/p>\n
PHP volunteers released a fix on Wednesday.<\/p>\n
\u201cIf you run PHP, it is imperative that you update now,\u201d the PHP Foundation, which funds developers working on the language, said in a blog post.<\/p>\n
Security firm Calif found the flaws in August using OpenAI\u2019s GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP\u2019s code.<\/p>\n
Google-owned Wiz said it found them independently weeks later with help from AI models including Google\u2019s Gemini 4 Argon and GPT-5.6 Sol.<\/p>\n
OpenAI said on X that it considered the bug \u201cone of the most impactful vulnerabilities in recent memory\u201d, adding that it \u201cmarks a new phase, where AI can find security bugs with internet-scale impact\u201d.<\/p>\n
\u2018Often and fast\u2019 <\/p>\n
Ethan Mollick, a professor at the University of Pennsylvania\u2019s Wharton School who studies AI, said that companies he talks to are struggling to keep up with the pace of patches needed to shield from AI-driven cyberattacks.<\/p>\n
\u201cNow consumers are going to have the same experience of getting everything updated often and fast,\u201d he wrote on X.<\/p>\n
The flaws had been reported privately to PHP\u2019s developers and kept confidential while a fix was prepared.<\/p>\n
Details leaked online Tuesday, a day before the planned release of the fix, prompting the rush to take sites offline.<\/p>\n
In France, local government websites, including one for Paris police, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, the interior ministry said.<\/p>\n
In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cyber security centre went offline as a precaution, according to Dutch public broadcaster NOS.<\/p>\n
Belgium\u2019s foreign ministry temporarily took its websites offline as a precaution, it said on X, although the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.<\/p>\n
In Australia, the Australian Signals Directorate said its own cyber.gov.au site was among government websites affected by the flaws, according to public broadcaster ABC.<\/p>\n
– AFP<\/p>\n","protected":false},"excerpt":{"rendered":"Attackers could use them to take over web servers without needing a password. Volker Dusch, a security engineer…\n","protected":false},"author":2,"featured_media":637358,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[74,26696,365,665,806,53669,138,10748,8556,11728,4510,6097,4053,23468,29419,266,359,29819,1452,776,3242,6804,111,139,69,43059,43111,2437,2122,6753,1361,32568,1680,377,28367],"class_list":["post-637357","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-after","tag-agencies","tag-ai","tag-around","tag-as","tag-basis","tag-business","tag-came","tag-companies","tag-critical","tag-dark","tag-down","tag-exposes","tag-flaws","tag-go","tag-government","tag-internet","tag-involving","tag-issues","tag-language","tag-large","tag-light","tag-new-zealand","tag-newzealand","tag-nz","tag-php","tag-programming","tag-security","tag-share","tag-shut","tag-that","tag-websites","tag-wednesday","tag-world","tag-worldwide"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/637357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=637357"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/637357\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/637358"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=637357"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=637357"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=637357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}