AI-assisted research uncovered two critical PHP vulnerabilities that could let attackers execute code remotely without authentication; developers released fixes on Oct. 21 after details leaked the day before. Authorities urged immediate patching or temporary shutdowns, and services went offline in several countries; Amazon reported exploitation activity while the PHP Foundation said it had seen no evidence of successful exploitation.
Summary written by our automated pipeline from the outlets' reporting. How it works
Grouped by where each speaker is from. Quotation marks are the speaker's own words; other lines are our summaries.
Moses said security patch application cycles should be cut from the current 7 to 30 days to hours.
Our summary of Yonhap News Agency
Moses emphasized that the incident shows the speed at which attack tools are built after a vulnerability is disclosed is increasing.
Our summary of The Hankyoreh
Points where outlets or parties give conflicting facts or readings. Each side is summarised by our pipeline; its sources are listed under it.
Amazon said the flaws were broadly exploited in the wild; Aikido Security’s Medlin Lawrence said attack cases had been reported, and Der Spiegel cited early reports of criminal attacks.
Amazon · our summary of Rappler
Medlin Lawrence, Aikido Security professional · our summary of Yonhap News Agency, via Reuters
Reactions from other countries and bodies, others involved, and commentary.
“…check whether your live site uses PHP and prepare to apply the new fix”
Quoted in Rappler
“No large public-facing critical services are being affected by the exercise”
Quoted in PBS NewsHour, via Associated Press
“The flaw found in PHP could affect a number of websites and requires an urgent response as exploit codes have already been made publicly available”
Quoted in Yonhap News Agency
“We are taking this situation extremely seriously”
Quoted in CBC News
Some organizations decided to take their websites offline as a precaution until a patch was available.
Our summary of Xinhua
Karsten Wildberger says there are currently no indications of a successful compromise of federal administration systems.
Our summary of Der Spiegel, via Bild
“…aktuell keine Hinweise auf eine erfolgreiche Kompromittierung von Systemen der Bundesverwaltung”
Machine translation: “…currently no indications of a successful compromise of systems of the federal administration”
The FBI recommended that operators take websites offline if they cannot update them immediately.
Our summary of PBS NewsHour, via Associated Press · also 1 other outlet
ANSSI said the update fixes two critical vulnerabilities whose rapid exploitation is a concern.
Our summary of CNews
“Elle corrige deux vulnérabilités critiques dont l’exploitation rapide est à craindre”
Machine translation: “It fixes two critical vulnerabilities that could be exploited quickly.”
The NCSC says the patch would protect underlying systems that rely on PHP.
Our summary of Xinhua
“…among the most severe vulnerabilities discovered in PHP and arguably in software history”
Quoted in South China Morning Post · also 2 other outlets
Cyber security authorities are warning website owners to fix the weaknesses immediately.
Our summary of BBC News
“All PHP users are strongly encouraged to update immediately”
Quoted in Deutsche Welle · also 3 other outlets
“…probably one of the worst vulnerabilities that I've ever seen”
Quoted in CBC News
“…might have already have gained a foothold”
Quoted in BBC News
“We have enormous capability to handle these risks.”
Quoted in BBC News
“SMEs and startups often lack in-house security personnel, making it difficult for them to assess the risks even when they receive vulnerability reports”
Quoted in The Hankyoreh
AI was powering a race to exploit.
Our summary of Daily Maverick · also 1 other outlet
Rappler relayed Calif’s account that it found the PHP flaws with an AI language model on Aug. 1.
Sources: Daily Maverick
Calif found the flaws with the help of a large language model on August 1 and had been working on a fix since.
The Hankyoreh reported that Calif found the first vulnerability on Aug. 11 and reported it to PHP developers.
Sources: The Hankyoreh
Calif said it found the first vulnerability using OpenAI's GPT-5.6 Sol model and reported it to PHP developers in August.
Amazon’s threat intelligence team said it detected a PHP exploit attempt in honeypot data on Oct. 17.
Sources: The Hankyoreh
Amazon's threat intelligence team confirmed an attempt to exploit the PHP vulnerability on 17 October in honeypot observation data.
“아마존 위협 인텔리전스팀이 허니팟(미끼 서버)의 관측 자료에서 17일에 피에이치피 취약점을 악용한 시도를 확인했다”
No translation yet.
Scheduled: The PHP Foundation was scheduled to disclose two severe vulnerabilities and patches at 14:00 UTC on Oct. 21.
Sources: The Hankyoreh
The PHP Foundation was scheduled to disclose two severe PHP vulnerabilities, which allow malicious code execution on servers without authentication, and their patches at 14:00 UTC on 21 October.
PHP developers released security patches for the vulnerabilities on Oct. 21.
Sources: The Hankyoreh (via Wall Street Journal and Reuters)
PHP developers released a security patch fixing two critical vulnerabilities that let hackers execute code on systems, on 21 October local time.
Government agencies and companies around the world shut down websites on Wednesday after two critical PHP flaws came to light.
Sources: South China Morning Post
Government agencies and companies around the world shut down websites on Wednesday after two critical PHP flaws came to light.
Japan’s Finance Ministry suspended some homepage content and services on Oct. 21 for emergency checks and patching.
Sources: Yonhap News Agency
The Ministry of Finance said it temporarily suspended some homepage content and services for emergency checks and patch application.
French local-government websites, including the Paris Police Prefecture, were inaccessible from Wednesday afternoon at the French agency’s request.
Sources: Clarín
French local government websites, including the Paris Police Prefecture, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency.
The Interior Ministry said the sites were taken offline after detection of a critical security vulnerability.
“…detección de una vulnerabilidad crítica de seguridad”
Machine translation: “…detection of a critical security vulnerability”
Sanae Takaichi urged website operators on the night of Oct. 21 to check for PHP and prepare to apply the patch.
Sources: The Hankyoreh
Takaichi asks website operators to check whether they use PHP and to prepare to apply the patch due at 11 p.m. tonight as quickly as possible.
“현재 운영 중인 웹사이트에 피에이치피 사용 여부를 확인하고 오늘 밤 11시에 공개될 수정 패치를 최대한 신속하게 적용할 준비를 해 주시기 바란다”
Machine translation: “Please check whether PHP is used on the websites currently in operation and be prepared to apply as quickly as possible the security patch to be released at 11 p.m. tonight.”
Takaichi says that temporarily suspending website operations can be an effective measure to reduce risk if a patch cannot be applied immediately.
“수정 패치를 곧바로 적용하기 어려운 경우에는 웹사이트 운영을 일시 중단하는 것도 위험을 줄이는 효과적 대책의 하나”
Machine translation: “If it is difficult to apply the security patch immediately, temporarily suspending website operations is also one effective measure to reduce risk.”
The UK National Cyber Security Centre issued an alert on Wednesday urging organizations to install available security updates.
Sources: Xinhua
Britain's National Cyber Security Centre urged organizations to take immediate action to install the available security updates.
Cloudflare CEO Matthew Prince posted late on Wednesday that the network had seen thousands of exploit attempts before public announcement and a rapid increase afterward.
Sources: Rappler
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it”
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now”
South Korea raised its cyber warning level to Caution as of noon on Thursday, Oct. 22.
Sources: Yonhap News Agency · The Korea Herald
South Korea's science ministry raised the country's cyber crisis warning level up a notch on Thursday.
South Korea raised its cybersecurity alert for the private sector from Interest to Caution on Thursday.
South Korea’s National Security Office held an emergency meeting on Thursday to coordinate the government’s response.
Sources: The Korea Herald · Yonhap News Agency
The meeting brought together senior officials from the Ministry of Science and ICT, the Ministry of National Defense and the National Intelligence Service.
The National Security Office subsequently held an emergency meeting to coordinate the government's response to PHP-related cyber threats.
Thirty-two UK government services were offline on Thursday, and four others were partly unavailable.
Sources: Okaz · Daily Jang
32 government services stopped operating on Thursday.
Baroness Lloyd said 32 government services went offline due to potential global cybersecurity issues.
Baroness Lloyd said four government services were partially disabled.
Nadella spoke at a company event in Cologne on Thursday and described a long day and night for IT and security staff.
Mitsubishi UFJ Financial Group said on Thursday it was temporarily suspending some internet services as an emergency measure.
Sources: Rappler
Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services due to emergency measures.
Scheduled: Japan’s Health Ministry planned to resume its care-service information disclosure system at noon on Oct. 23.
Sources: The Hankyoreh
The ministry plans to resume its information disclosure system at noon tomorrow.
Each outlet's headline, linked to its article. Non-English headlines are machine-translated. The groupings and notes on what each outlet emphasises are automated.
None of our outlets is based in New Zealand. Our outlets in Japan and Australia didn't cover it.
Written by our automated pipeline from the statements in the coverage; each point lists the statements it rests on.
Reports place Calif’s AI-assisted discovery work on Aug. 1 or Aug. 11; Wiz said it independently found two flaws using AI tools and worked with OpenAI on discovery and patching.
Calif · our summary of Rappler
Calif · our summary of Daily Maverick
Calif · our summary of The Hankyoreh
Our summary of Yonhap News Agency
The flaws each scored 9.2 out of 10 on the CVSS scale and could allow remote code execution without authorization. Wiz estimated PHP runs about 70% of websites; W3Techs put the share at 75% among websites whose programming language can be identified.
Our summary of Meduza
Our summary of Meduza
Our summary of Yonhap News Agency
Wiz · our summary of CBC News
Details leaked online on Oct. 20, before a planned release on Oct. 21. PHP developers released fixes on Oct. 21 and urged users to update immediately; available updates covered PHP 8.2 and later, with patches for some older versions also reported.
Our summary of Clarín
Our summary of Deutsche Welle
Our summary of The Hankyoreh
PHP developers · our summary of The Hankyoreh, via Wall Street Journal and Reuters
Reports of exploitation conflict. Amazon said the flaws were broadly exploited and Aikido Security said attack cases had been reported; the PHP Foundation said it had seen no evidence of successful exploitation, and the BBC said no successful attacks had been reported at the time of its account.
Amazon · our summary of Rappler
Medlin Lawrence, Aikido Security professional · our summary of Yonhap News Agency, via Reuters
PHP Foundation · our summary of CBC News
Our summary of BBC News
Cloudflare CEO Matthew Prince reported thousands of attempts in the 10 hours before public announcement, rising to tens of thousands within 45 minutes afterward, hundreds of thousands within two hours and millions by the time of his post. Amazon said its team detected an attempt against a honeypot on Oct. 17.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it”
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now”
CJ Moses, Amazon security executive · our summary of The Hankyoreh
“아마존 위협 인텔리전스팀이 허니팟(미끼 서버)의 관측 자료에서 17일에 피에이치피 취약점을 악용한 시도를 확인했다”
No translation yet.
CJ Moses, Amazon security executive · our summary of Rappler
Precautionary shutdowns affected government, business and media services in multiple countries. Baroness Lloyd said 32 UK government services were offline and four partly unavailable, mainly because of security precautions; the Prime Minister’s Office said no large public-facing critical services were affected.
Our summary of Xinhua
Baroness Lloyd, UK government minister · our summary of Daily Jang
Baroness Lloyd, UK government minister · our summary of Daily Jang
Liz Lloyd, British government official · our summary of Xinhua, via Sky News
Japan urged website operators to check for PHP and prepare to patch, while ministries suspended some services. South Korea raised its private-sector alert to Caution, asked organizations to update and convened an emergency meeting; its presidential office said public institutions and the military had relatively low exposure because PHP use was limited.
Sanae Takaichi, Japan's prime minister · our summary of The Hankyoreh
“현재 운영 중인 웹사이트에 피에이치피 사용 여부를 확인하고 오늘 밤 11시에 공개될 수정 패치를 최대한 신속하게 적용할 준비를 해 주시기 바란다”
Machine translation: “Please check whether PHP is used on the websites currently in operation and be prepared to apply as quickly as possible the security patch to be released at 11 p.m. tonight.”
Sanae Takaichi, Japan's prime minister · our summary of The Hankyoreh
“수정 패치를 곧바로 적용하기 어려운 경우에는 웹사이트 운영을 일시 중단하는 것도 위험을 줄이는 효과적 대책의 하나”
Machine translation: “If it is difficult to apply the security patch immediately, temporarily suspending website operations is also one effective measure to reduce risk.”
Minoru Kihara, Japanese government official · our summary of Xinhua
Ministry of Health, Labour and Welfare, Japan's health ministry · our summary of The Hankyoreh
Organizations faced different patching burdens. Don Smith urged them to locate every PHP installation and check for signs of access; Loganaden Velvindron said end-of-life versions required rebuilding applications and changing code, while Felix Kulenkamp said complex systems and smaller organizations might need more time.
Don Smith, Cybersecurity analyst · our summary of BBC News
“…might have already have gained a foothold”
“Many versions of php running are completely end-of-life”
Felix Kulenkamp, Bitkom representative · our summary of Yonhap News Agency
“대규모 업체들은 상당수가 이미 업데이트를 완료했으나, 복잡한 IT 시스템이나 소규모 기관들은 더 오랜 시간이 걸릴 수 있다”
No translation yet.
The PHP Foundation called the delay in implementing a solution a structural failure involving resources and the security team’s decision process. OpenAI said it coordinated an international response through Patch the Planet and called for more resources for defenders. Experts also discussed AI-assisted attacks, the capacity to manage risks, alert fatigue and the need for systems that can be maintained securely.
International and wire-service coverage: Global security guidance, the vulnerabilities’ reach and precautionary shutdowns in multiple countries.
Japan and South Korea coverage: Public alerts, emergency coordination and ministry or company service suspensions.
European coverage: Government and public-service outages, local cybersecurity capacity and officials’ explanations of precautions.
Canadian coverage: Canadian government sites, patching demands and the time organizations may need to update.
Publisher logos load from the publishers' own sites. Report an error on this page · Corrections
A code editor displaying PHP source code, photographed on May 21, 2020. Place not specified.
File:PHP Code (49919079151).jpg · Yuri Samoilov · CC BY 2.0
PHP Code
Creator Original sourceCreative Commons Attribution 2.0
.jpg){kind=link}