Latest
  1. Johns Hopkins Bayview tells 3,182 patients an employee put their health data into a public AI tool
  2. China’s AI compute access expected to double in 2027, with US-designed chips about 65 per cent
  3. UK commits £100m to national AI Biosecurity Lab
  4. Moonshot AI releases Kimi K3.1 Pro with 1-million-token context window
  5. Residents in Newport and Cardiff oppose hyperscale datacentres near homes
  6. Study: Grok 4.7 picked Republicans in 92% of forced midterm answers, GPT-6.1 Sol picked Democrats in 97%
  7. Attackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says
  8. Elvis Presley’s rightsholders sue Anthropic over training on 274 songs

Latest / Frontier models and safety

IncidentFrontierGovernmentInternational France Australia SingaporeReported

AI-found PHP flaws push governments and companies to take websites offline

See how this story connects

Source: AFP via The HinduAlso reported by PHP security advisory, The Straits Times, Nikkei Asia, The Guardian

PHP released fixes on 21 October 2026 for two critical flaws that can let an unauthenticated web request run code on a server, a day after details leaked online. Government agencies and companies took sites offline as a precaution, among them French local government sites including one for the Paris police, the Dutch DigiD identity service and Australia’s cyber.gov.au. The security firm Calif found the flaws in August with OpenAI’s GPT-5.6 Sol, in an OpenAI-funded audit of PHP’s code; Wiz, owned by Google, found them weeks later with help from Gemini 4 Argon and GPT-5.6 Sol.

Why it matters

OpenAI said the discovery marks a new phase in which AI can find security bugs with internet-scale impact. Singapore’s Cyber Security Agency told organisations to patch now and reported widespread exploitation attempts and several proof-of-concept exploits.

When
21 Oct 2026
ID
WTA-N-2026-0372
Who
PHP Foundation, Calif, Wiz, OpenAI, Google, Cyber Security Agency of Singapore; Gwenda Fong
System
OpenAI GPT-5.6 Sol and Google Gemini 4 Argon, used to find the flaws
Operator
Calif (OpenAI-funded audit of PHP) and Wiz
Type
two critical PHP flaws letting an unauthenticated request run code; websites taken offline as a precaution
Status
fixed on 21 Oct 2026; widespread exploitation attempts reported; disclosed by PHP security team; details leaked a day before the fix · Incident ledger

Summary by wheresthe.ai, from AFP via The Hindu and the reporting credited above. We could not open the primary document, so it is marked Reported. Checked against the source on 23 Oct 2026.

Read the original at AFP via The Hindu

Source copy: download the page as saved on 23 Oct 2026 (PDF). Also held by the Internet Archive.

Next stop on this Storyline: Led toAttackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says

Cite this story

WTA-N-2026-0372: “AI-found PHP flaws push governments and companies to take websites offline.” wheresthe.ai, 21 Oct 2026. https://wheresthe.ai/d/intl-ai-found-php-flaws-take-websites-offline-2026-10/ (source: AFP via The Hindu).

Spotted an error? Email [email protected].