Global Cyber Agencies Sound Alarm Over Flaws Threatening Most Websites

2026-10-29 data

Brussels, Thursday, 29 October 2026.
Artificial intelligence uncovered decade-old flaws in software that powers 70 percent of the internet, prompting urgent global warnings to patch critical remote execution vulnerabilities before widespread exploitation occurs.

AI Discovery Exposes Decades-Old Core Flaws

The cybersecurity ecosystem faces a major structural challenge following the discovery of severe vulnerabilities in PHP, an engine powering 70% of all websites globally, including widely deployed content management systems such as WordPress, Joomla, Drupal, and MediaWiki [3]. The vulnerabilities, dubbed ‘php2shell’, were uncovered on August 19, 2026, through automated vulnerability research conducted by Wiz Research [3]. Security researchers utilized advanced frontier artificial intelligence systems—specifically Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol—to bridge complex exploitation barriers and identify systemic security weaknesses that had remained hidden across every PHP version released over the previous decade, dating back to PHP 5.4 [3].

How Frontier AI Unlocked Novel Vulnerabilities

This technical innovation illustrates the transformative benefits of deploying frontier AI for cyber defense, enabling automated auditing mechanisms to decipher complex architectural flaws in core interpreters [3]. According to Raluca Ada Popa, Head of Gemini Security at Google DeepMind [alert! ‘source does not specify the city/country location for Google DeepMind or Wiz Research’], Gemini 4 Argon served as a game-changer by addressing issues where vulnerability discovery and exploitation had previously been too difficult for manual analysis alone [3]. Working alongside research initiative Calif via OpenAI’s Patch the Planet framework, security investigators demonstrated unauthenticated remote code execution on August 20, 2026, against Drupal, followed by WordPress on August 21, 2026 [3][4]. Researchers isolated four specific flaws: an Upload-Progress Unserializer Use-After-Free, Remote Process-Memory Disclosure, a Fatal-Error Backtrace Use-After-Free, and an OPcache Type Confusion bug [3].

Global Threat Escalation and Accelerated Patching

Wiz Research reported these findings to the upstream PHP security team on August 24, 2026, leading to official acknowledgment on September 21, 2026 [3]. However, an unexpected leak on Hacker News on October 20, 2026, compromised the coordinated disclosure timeline and accelerated defensive measures globally [4]. The PHP development team released emergency updates on October 21, 2026, addressing the flaws tracked as CVE-2026-109618 and CVE-2026-109619, both carrying a critical Common Vulnerability Scoring System (CVSS) rating of 9.2 [1][3][4]. The newly deployed patched releases comprise versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 [2][4][5]. The emergency also revealed a third remote code execution issue on October 23, 2026, cataloged as CVE-2026-115560, which impacts non-standard server environments [5].

International Agencies Issue Urgent Mitigations

International defensive bodies immediately moved to mitigate exposure across commercial and governmental digital infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on October 26, 2026, after releasing SIGMA detection rules on October 23 and October 25 to assist log analysis [2]. Multilateral coordination involved the European Commission’s Directorate-General for Communications Networks, Content and Technology (DG CNECT), the European Union Agency for Cybersecurity (ENISA), CERT-EU, Europol EC3, the national CSIRTs network, the U.S. National Security Agency (NSA) based in Fort Meade, Maryland, the United Kingdom’s NCSC, Australia’s ASD ACSC, New Zealand’s NCSC, and the Canadian Centre for Cyber Security [1][2][6]. Furthermore, the Federal Bureau of Investigation (FBI) in the United States amplified the warnings to protect online platforms [7].

Operational Mandates and Compliance Deadlines

The operational impact extends across all web-serving architectures, including Apache using mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed [2][4]. Cybersecurity authorities advise system administrators unable to patch immediately to disconnect internet-facing services or implement configuration mitigations, such as disabling upload progress tracking via ‘session.upload_progress.enabled=0’ and setting ‘memory_limit=-1’ [1][2][5]. In the European Union, regulatory requirements under Regulation (EU) 2024/2847—the Cyber Resilience Act (CRA)—mandate that product manufacturers report actively exploited vulnerabilities through the CRA Single Reporting platform as of September 11, 2026, ahead of the core security-by-design obligations taking effect on December 11, 2027 [1]. Academic and commercial organizations, including the University of Washington, have enforced null-routing protocols to isolate vulnerable web applications running WordPress, Drupal, Nextcloud, and phpMyAdmin until verified patches are deployed [7].

Bronnen

Cybersecurity PHP vulnerability