Noesion Radarnoesion.ai
Incident2026-10-22

AI discovered two critical flaws in PHP, a language powering much of the web. The PHP Foundation rushed out a fix after details leaked. Governments and agencies worldwide urged sites to patch or go offline. Finland, the Netherlands, and the BBC took pages down as a precaution. The flaws allow attackers to access servers or databases. Early attacks have already emerged. The fix covers only the latest PHP versions. Older versions must upgrade to 8.1 first. The flaws went undetected for over ten years. AI tools from OpenAI helped uncover them.

What changed

The flaws had gone undetected for over a decade.

What it unlocks

Organisations can now patch PHP to prevent unauthenticated remote code execution.

  • ~70% of the internet affected
  • PHP 5+ affected (2004 onwards)
  • fix released 2026-10-22

What you need to act on it

  • PHP 8.1 or newer
  • ability to apply the patch before taking systems offline

Sources

Send this to someone who needs it

Shares the story and its sources. Nothing about you.

What does this mean for your job?

This is the story as everyone gets it. Once a week we send you the version written for your role — what changed, why it matters for the work you actually do, and one thing to try. Free while we tune it.