Patches Released for Serious PHP Flaws as Hackers Struggle to Exploit Them So Far

Patches were released Wednesday for two serious vulnerabilities in PHP, a programming language used by an estimated 69% to 70% of websites, and governments and companies worldwide scrambled to apply them. Researchers found the flaws in August, reportedly using advanced AI models from OpenAI and Google, and developed fixes quietly across borders before announcing them. Governments warned that sites should consider going offline until fixed. By Thursday, Sophos threat research vice president Don Smith said his firm had seen only a couple of real exploitation attempts, and few reports of widespread damage existed. Experts said the threat could last weeks or longer. Figma's John Milinovich said on X that attacks in two days were severe.

Right-leaning outlets had not reported this story at the time of writing; left-leaning and alternative outlets had. Alternative outlets framed it differently: CNBC stressed AI-security alarm and quoted Milinovich, while Straight Arrow News asked whether it was catastrophe or routine, noting the bug was long known. Left outlets differed too: CBS relayed a Reuters reporter's severity warning, while NBC emphasized limited exploitation so far.