October 22, 2026
Governments and major companies, led by Amazon, have mobilized their efforts to address critical security vulnerabilities in the PHP programming language, on which a large percentage of websites depend, amid serious fears that it will be exploited to steal data, disrupt services, and access internal systems.
According to a report published by the British Broadcasting Corporation (BBC), the British government announced that it is working to examine its electronic services and address any potential weaknesses, in parallel with calls made by the competent authorities in Britain, the European Union, and Australia to institutions that use PHP to install security updates immediately. For its part, the US National Security Agency warned that these vulnerabilities provide direct access to the file system and databases on servers, explaining that the flaw lies in the PHP language itself and not in the applications or their settings, while the company “OpenAI” described the discovery as one of the most prominent security problems with a wide impact in recent times.
In the same context, the National Cyber Security Center in Britain warned organizations that if the vulnerabilities cannot be fixed immediately, they must temporarily stop the affected systems until the problem is completely addressed. These precautionary measures have been extended to include a number of global institutions. The Dutch Cybersecurity Agency temporarily suspended its services, the Finnish government closed its public online services, while Wikipedia disabled parts of its site in response to government recommendations.
In terms of monitoring attacks, Amazon revealed that it had detected an attempt to exploit vulnerabilities called “PHP2Shell” on October 17, targeting an experimental system that the company uses to lure and monitor attacks. The company’s head of security, CJ Moses, explained that the Internet address used was unknown, which suggests that a cyber threat actor was behind the attempt. Moses added that other attacks targeted the company on the 21st of the same month, after details of the vulnerabilities were leaked via social media sites and before the ban on security warnings was lifted, noting that the difference in tools and infrastructure to hide the identity of the attackers indicates the involvement of multiple parties.
It is reported that the PHP Foundation had planned to announce these vulnerabilities later in the month in conjunction with the release of remedial updates, but leaking details hastened exploitation attempts. Moses emphasized that the use of artificial intelligence gives many parties the ability to launch attacks within hours or even minutes of revealing technical details. This opinion was agreed by the CEO of the Australian Council for Artificial Intelligence Strategy, Anna Maria Arabia, who told the BBC that the incident reflects the rapid speed with which artificial intelligence is affecting cybersecurity, as vulnerabilities that used to take months are now being discovered within days, warning of the escalation of these threats with technical acceleration.
While the cybersecurity company “Wiz” estimated that about 70% of websites may be affected by these vulnerabilities – a percentage that the BBC was not able to independently verify – it was reported that these vulnerabilities remained hidden and undetected for at least ten years.
