@BalaiBB: a critical vulnerability was just discovered in PHP. the language that runs 80% of the internet severity score: 9.2 out…
Summary
A critical PHP vulnerability with a 9.2 severity score threatens to allow full server compromise, with fears that attackers will use AI to reverse-engineer the patch within 15 minutes of its release, alongside a publicly leaked exploit.
View Cached Full Text
Cached at: 10/21/26, 02:36 PM
a critical vulnerability was just discovered in PHP. the language that runs 80% of the internet
severity score: 9.2 out of 10. that’s about as bad as it gets
what can an attacker do with this? take full admin control of a server. steal entire databases. passwords, credit cards, payment histories. plant malware and use the server to attack other systems
but here’s the terrifying part that most people missed
the moment the patch drops tonight attackers are expected to use AI to reverse engineer what was fixed within 15 minutes
15 minutes. that’s the window between the fix going live and automated attacks launching worldwide
every online store, booking site, and corporate system running PHP that doesn’t update in those 15 minutes becomes a target
this isn’t just a developer problem. if you’ve ever signed up to a website, entered your card details, or created an account online your data is sitting on servers that might be vulnerable right now
and someone just publicly dropped the working exploit on twitter before the patch was even ready. gave every attacker on earth a head start
engineers worldwide are pulling all-nighters tonight to patch their systems before the attacks begin
change your passwords on any service that matters to you. enable 2FA everywhere. and watch out for fake “maintenance” or “password reset” emails over the next few days
the internet is about to have a very long night
Similar Articles
A critical PHP vulnerability may take websites down today
Two critical PHP Remote Code Execution vulnerabilities (9.2/10 severity, affecting PHP 5 onward) prompted emergency patches, with cybersecurity agencies advising unpatched sites to go offline. Over 1.3 million hosts and all WordPress sites are potentially affected, with experts anticipating mass attacks within minutes of the release.
Websites taken down worldwide as critical PHP cyber-security update issued
Two critical PHP vulnerabilities, described as the most severe ever discovered by AI, prompted global governments and agencies to take websites offline while awaiting fixes. The flaws, found by researchers at Calif and Wiz using OpenAI models, had gone undetected for over a decade and reportedly affect roughly 70% of the internet.
PHP: The three little letters wreaking havoc across the web
Two severe vulnerabilities disclosed in PHP affect nearly 20 years of versions, knocking major sites like Wikipedia, WordPress-backed platforms, Internet Archive, and Cloudflare-protected services offline and forcing some old Japanese mobile games to permanently shut down.
Widespread PHP Flaw May Cause Many Site Outages Today
Two critical PHP zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4 and later are being exploited in the wild, prompting an emergency PHP release and outages across countless sites, with OpenAI and Wiz involved in the research and disclosure.
PHP warns it plans to release 2 emergency patches imminently
PHP maintainers warn of two critical vulnerabilities rated 9.2/10 and plan to release emergency security patches within 12 hours, urging all PHP users to prepare to upgrade immediately.