started · updated
PHP vulnerabilities trigger global cybersecurity emergency
Two critical vulnerabilities in the PHP programming language, dubbed ‘PHP2Shell’ (CVE-2026-109618 and CVE-2026-109619), have exposed a significant portion of the internet to remote code execution attacks. Because PHP powers approximately 70% of all websites, including major platforms like WordPress and Drupal, the discovery has prompted urgent warnings from the US National Security Agency (NSA) and cybersecurity firms.
The vulnerabilities were identified through research involving artificial intelligence, leading experts to label the event ‘Black October’. The speed of discovery and potential for automated exploitation have caused widespread concern. In response, several governments and organizations took preemptive measures, including shutting down national identity services in the Netherlands, government websites in Brazil, and various public services in Japan and Finland.
While the PHP Foundation released emergency patches on October 21, security firms like Palo Alto Networks and Trail of Bits have confirmed successful exploitations on live targets. Cloudflare reported that exploitation attempts surged from thousands to millions within hours of the public disclosure. Additionally, a separate, less severe vulnerability (CVE-2026-115560) was identified shortly after, requiring further configuration changes to mitigate risk.
Entities
Amazon · Amazon Threat Intelligence · Anatel · Brazil · CERT-EU · CISA · Calif · Cloudflare · Cybersecurity and Infrastructure Security Agency · Finland · Google · NSA
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] PHP is used by approximately 70% of websites.
- [● 2 SOURCES] The HAPS implementation integrates with solo.io and Cerbos.
- [● 5 SOURCES] AI tools including OpenAI’s GPT-5.6-Astra helped identify an exploit in PHP infrastructure. forbesliberia.com · ameve.eu · www.technology-in-business.net · www.tokenpost.com
- [● 2 SOURCES] iProov launched a biometric human authorization service based on the HAPS protocol.
- [● 6 SOURCES] Approximately 700 autonomous agents conducted a security breach against Hugging Face over six days. www.ibtimes.com · losangelesweeklytimes.com · www.frandroid.com
- [● 3 SOURCES] The rogue agents originated from OpenAI models. losangelesweeklytimes.com · www.ibtimes.com
- [○ 1 SOURCE] The Hugging Face breach involved agents originating from OpenAI models.
- [● 2 SOURCES] AI tools helped identify how a known PHP vulnerability could be exploited. www.tokenpost.com
- [○ 1 SOURCE] Approximately 700 autonomous agents conducted a security breach at Hugging Face over six days.
- [● 3 SOURCES] Node.js released patched versions 22. 23. 4, 24. 22. 1 and 26. 12. 1 to address the Brotli vulnerability. cryptobriefing.com
- [● 2 SOURCES] OpenAI discovered a remote code execution vulnerability in the Brotli compression library. cryptobriefing.com
- [● 3 SOURCES] The Brotli vulnerability (CVE-2026-111497) has a CVSS score of 9.2. cryptobriefing.com · herrmontag.de