For ten years, a serious flaw sat undetected in the software behind most of the internet.
On Wednesday, the developers of PHP, the programming language behind the server side of about 70 percent of all websites, shipped emergency fixes for it, together with a second flaw discovered in the same work. Government agencies in the United States and Europe told organizations to apply the patch right away, and to consider taking sites offline where fast patching was not possible.
Most owners have never touched PHP and never will. Their web host or their website platform does the touching. That is what makes this worth reading: PHP runs WordPress, Drupal, Joomla, and the software behind Wikipedia, which puts it underneath a large share of the sites any of us open in a normal week.
The flaws themselves are the kind you cannot address from the front: they let an attacker run their own code on the server, or copy the memory the server holds while it works, which can include passwords and sign-in credentials. Researchers rated the worst of them 9.2 out of 10, near the top of the standard severity scale. The weakness sits in PHP itself, not in WordPress and not in a site's own code, so a plain informational page with nothing installed was as exposed as anything else. Every PHP release of the past decade carried at least one of the bugs.
The urgency on Wednesday came from what was already underway. The internet infrastructure company Cloudflare counted thousands of attempted break-ins before the details went public, and millions within a day of it (BBC, October 22). Amazon said attackers probed its sites in the days before the announcement.
The bug was old. The tooling was new.
Security firm Wiz led the research, with AI models from Google and OpenAI in the middle of the work. The team found the first flaw on August 19. Turning it into a real attack required chaining weaknesses together and matching the exploit to each server's memory layout, adjusting for every difference in PHP version and configuration.
A world-class team, by Wiz's estimate, would have needed months to pull that off reliably. One researcher working with those models got there in about a week, and demonstrated takeovers of test installations of WordPress, Drupal, and Joomla with no login at all.
That is the shift, and it will outlast this headline. Old software has always carried a quiet defense: the deep flaws in it were so awkward to exploit that nearly every attacker passed. The flaw sat there for a decade either way. What arrived this year is tooling that can take old code and make it dangerous within days. In Wiz's own framing, AI changed the ability to understand the weaknesses and turn them into a working exploit.
The same tooling ran the other direction
Two months of quiet work sat behind Wednesday's announcement. The researchers notified the PHP developers in August and kept the details closed while fixes were built, tested, and coordinated through defense agencies in several countries, so patches were ready the same day the story went public. OpenAI, whose models took part, said the work surfaced the flaws before any attackers found them.
Defensive versions of this are available to businesses of any size, and it is worth spelling out. The useful pattern is a standing watch: a routine that reads news releases, vendor advisories, and security research on a schedule, filters them against what a particular business actually runs, and notifies a person when something major lands, with a summary and the first moves. The reading was always the expensive part. Hundreds of advisories flow past in a typical week and nearly all of them are irrelevant to any single business, and that filter used to require an experienced person with time that nobody had. Today the experience goes into the setup instead: which sources to read, what counts as major, and who gets told what.
This publication runs on that pattern. The Monday issue comes from a scheduled weekly scan; the post you are reading shipped midweek, ahead of the usual schedule, because the story was one of the rare ones that should not wait for the next issue. A business can arrange the same thing with its own advisors, and the setup is modest: the scan is the cheap part, and it separates hearing about a flaw in the week it breaks from hearing about it at the next scheduled maintenance visit.
What is worth doing this week
Nothing here requires new equipment. All three are questions:
Ask your web host whether PHP has been patched. The fix lives on the server that hosts the site, which usually belongs to a hosting company, and reputable hosts moved quickly once it shipped. A host that cannot answer the question has told you something anyway.
Keep the layers you control current. The flaw is not in WordPress or in your site's code, but the week's lesson applies to everything you own: software that was too complicated to attack last year may not stay that way. Current versions and plugins, applied when they ship.
Ask how your IT people learn about major problems. The answer is usually a matter of days versus weeks, and that difference is the whole point of a watch.
The bottom line
The gap between a hidden flaw and an active attack used to be measured in years of patient expert work. This week it was hours. That is worth hearing calmly, because the same compression runs in a business's favor: the warning timeline compressed too, and the warning is the part a business controls. A watch that runs on schedule, a patching habit that closes the window in the same week, and a person who owns the alert will do more for most businesses than any security product bought in a hurry. If nobody runs that watch on your side, have a conversation with someone who does this for a living.
Story reporting: Wiz Research, October 21, 2026; the Associated Press, October 22, 2026; the BBC, October 22, 2026; The New York Times, October 21, 2026.