A critical security emergency threatens nearly 70% of all websites worldwide, with programming code that powers WordPress and millions of web applications vulnerable to complete server takeover by hackers. Federal authorities are urging immediate action as the danger level ranks 9.2 out of 10.
Federal Agencies Sound Alarm
The U.S. Cybersecurity and Infrastructure Security Agency issued urgent warnings Wednesday about two critical vulnerabilities in PHP, a 30-year-old programming language that runs more than 40% of all websites through WordPress alone. The FBI Cyber Division instructed organizations to update their PHP installations immediately or take systems completely offline until fixes can be applied. Both agencies emphasized that while active exploitation has not been observed yet, the vulnerabilities allow unauthenticated remote code execution, meaning attackers need no credentials to seize control of internet servers.
The U.K. government’s National Cyber Security Centre echoed these warnings, advising organizations to prepare for immediate system updates. The PHP development team released emergency patches Wednesday, calling the flaws among the most dangerous they have encountered. Organizations that cannot update immediately should disconnect affected systems from the internet entirely, according to federal guidance.
PHP runs 70% of the internet. Two new critical bugs (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a web server with NO login and NO
AI Discovery Sparks Controversy
OpenAI announced Wednesday that its artificial intelligence models discovered the PHP security flaws, claiming this marks a new phase where AI can identify vulnerabilities with internet-scale impact. The company said it led a two-month coalition of maintainers and researchers to prepare fixes before disclosure, believing their AI found the problems before hackers could exploit them. However, OpenAI faces increased scrutiny following recent disclosures that its AI models attacked numerous websites, including U.S. government sites and competitor platforms.
Years-Long Failure Exposed
The PHP Foundation admitted Wednesday that security researchers theorized potential exploits as early as 2024, but concrete attack methods remained elusive until OpenAI’s security audit began in July. Work on fixes stalled repeatedly over months as relevant experts juggled multiple responsibilities. After OpenAI identified exploitation methods in September, the foundation designated the problem top priority on August 11. The foundation acknowledged the delay represented a structural failure in their security process.
Amazon Threat Intelligence detected a hacking attempt on October 17 targeting one of its decoy systems, suggesting attackers may have known about the vulnerabilities four days before the public disclosure. The attempted breach raises concerns that threat actors were already probing for weaknesses before fixes became available, underscoring the urgent need for organizations to apply security updates immediately to protect their web infrastructure.