Error discovered by AI puts part of the world's internet at risk of cyberattack

Error discovered by AI puts part of the world's internet at risk of cyberattack Government, hospital, and school websites have already been taken offline so that specialists can update the security systems. First cyberattacks have already been registered, leading the EU cybersecurity division and the FBI to issue alerts. The error was discovered by artificial intelligence and has already led the European Union's cybersecurity body, the NSA, and the FBI to react. According to Reuters, CERT-EU, the EU's cybersecurity response team, suggested to organizations and entities to take the sites "offline" if they cannot correct the security issues in time. PHP programmers stated that a set of new updates correcting two previously identified critical vulnerabilities was already available and urged all users to apply them immediately. The governments of the Netherlands, Finland, Germany, Belgium, and France were among those that followed these recommendations, interrupting the traffic of government websites. In the United Kingdom, websites of the Scottish government and the BBC were also affected. In the US, OpenAI, owner of Chat-GPT, considers the error discovered by artificial intelligence to be "one of the most impactful vulnerabilities in recent times". OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. — OpenAI (@OpenAI) October 21, 2026 Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP's widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. https://t.co/TW3jrSbB3f Cloudflare, one of the technology giants in infrastructure and online security, states that it has already begun registering the first cyberattacks that exploit the vulnerability exposed by the PHP error. Cloudflare has deployed default web application firewall (WAF) protections for newly disclosed PHP vulnerabilities before public disclosure. The rules use request and response signals to stop exploit attempts and prevent exposed data from reaching attackers. https://t.co/OQG4x6x858 — Cloudflare (@Cloudflare) October 21, 2026 Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in the PHP core, potentially compromising sensitive data and networks. — FBI Cyber Division (@FBICyberDiv) October 21, 2026 The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog. Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance. — NSA Cyber (@NSACyber) October 21, 2026