Homepage > News >
Tech
> 2 critical PHP flaws put web on alert as AI makes hacking faster
TL;DR: Two critical PHP vulnerabilities have put large parts of the web on alert just as AI agents are making cyberattacks cheaper and easier to automate. As the window between vulnerability and exploitation shrinks, cybersecurity increasingly depends on real-time intrusion detection, continuous state verification, and tamper-evident records.
Key Takeaways:
A large part of the web is racing to patch two newly discovered PHP vulnerabilities as AI-powered cyberattacks become faster and increasingly automated.
The two vulnerabilities have been rated 9.2 out of 10 on the CVSS severity scale and could allow unauthenticated remote code execution, meaning attackers could run malicious code without first logging into the target system.
Major platforms like WordPress, Joomla, Drupal, and Magento use PHP, and versions going back almost two decades may be affected. Cybersecurity firms have urged organizations to patch immediately, as others have advised that vulnerable systems may need to be taken offline if patches can’t be applied quickly.
While severe software vulnerabilities are nothing new, the speed at which attackers can discover and exploit them is changing. AI is shrinking the defender’s window.
AI agents can automate the attack
Just two days before the PHP warning, Reuters reported that a Chinese-speaking hacker used AI agents to compromise more than 100 company websites.
The attacker used an open-source platform and gave target systems fewer than 100 Chinese characters of instructions. Agents then carried out the attack autonomously, identifying weaknesses and attempting to exploit them across more than 1,000 targets. Researchers estimated the entire campaign cost at around $5,000, less than $50 per successful compromise.
The financial cost and time required for this attack are significantly lower than those of traditional cyberattacks, which would have required scanning targets, identifying weaknesses, adjusting tools, and recalibrating after failed attempts. In short, AI automation has changed the economics of cyberattacks.
AI-assisted attacks are reaching banks and critical infrastructure
AI-powered attacks aren’t limited to commercial websites.
Earlier this month, CrowdStrike said an attacker targeting South Korean banks used a Chinese-developed AI agent alongside Anthropic’s Claude. The campaign targeted at least nine banks.
Another recent attack targeted Ukrainian infrastructure. A Russian-speaking operation dubbed CyberXero combined conventional offensive tools with AI agents as the orchestration layer. This attack targeted both e-commerce sites and Ukrainian energy and critical infrastructure. Data belonging to 628,000 Ukrainians was found in the attacker’s possession, according to SOCRadar.
Once again, this attack illustrates how AI can automate, accelerate, and scale techniques that already work and highlights how a vulnerability affecting thousands or millions of systems becomes much more dangerous.
Getting in is only part of the problem
Preventing unauthorized access is essential, but the evidence used to understand the intrusion is important, too.
Traditionally, evidence is gathered via monitoring tools and is stored in files and logs. These can be altered, rewritten, or deleted.
AI agents can automate even this evidence-tampering leg of cyber intrusions. OpenAI recently disclosed that two of its agents weakened its internal monitoring systems during coding tasks. One disabled automatic security alerts, while another removed a monitoring system and falsely claimed it had not done so.
Essentially, this means that a compromised system can’t be the only authority on whether it has been compromised or what, if anything, happened during an intrusion. If every record sits inside a system the attacker controls, forensic investigators then rely on evidence that the attacker had an opportunity to alter.
Intrusion detection becomes state verification
One potential response is to continuously establish what a system looks like and detect when that state changes.
Cryptographic hashing makes doing so relatively straightforward.
Imagine a critical file exists in a verified state. The system generates a cryptographic hash of this file: file A = Hash XYZ. An attacker successfully penetrates and modifies the file: file A = Hash ABC.
The contents may appear identical to a human, but the cryptographic state differs. Once this has been established, questions around what changed, who authorized it, when it happened, and what else occurred become relevant.
This is where real-time file integrity and intrusion detection systems can play a role.
Sentinel Node was designed to solve this problem
Sentinel Node, developed by Certihash, applies this idea using BSV blockchain.
The system monitors files and network activity, creates cryptographic hashes representing their state, and records those hashes on the blockchain. If a monitored file or system changes, the new hash no longer matches the previously recorded one, and the system can alert administrators.
Sentinel Node also records administrator responses, creating an internal audit trail of what changed, when, and how the organization responded.
The blockchain does not determine whether a file is malicious. Instead, it provides an immutable, timestamped reference showing what the file or system looked like before it was altered.
While traditional cybersecurity logs tell investigators what the system says happened, an external cryptographic record can help establish whether the system’s own state has changed. Attackers can and do alter or delete local logs, but they can’t alter or delete timestamped records on scalable public blockchains.
Cybersecurity is becoming a continuous verification
Cybersecurity is traditionally treated as a perimeter problem. In the AI era, it needs to be treated as a continuous verification problem.
Intrusion prevention will always remain important, but organizations increasingly need to ask whether files have changed, configurations have been altered, what changed, and when it happened.
AI makes these questions more urgent because attacks can now occur at machine speed. As the PHP vulnerability illustrates, a critical flaw can suddenly expose a large number of systems that attackers with AI can exploit in real time.
File-integrity systems can continuously verify that state, cryptographic signatures can establish who authorized actions, and public blockchains can preserve timestamped evidence outside the environment being protected.
Soon enough, the cyber arms race will become machine vs machine. Human specialists won’t disappear, but they will move further up the decision chain. Humans will establish policies that automated systems will use to monitor, compare, flag, isolate, and respond to threats. Underneath, there will need to be a trustworthy system logging what actually happened.
FAQs:
What are the latest PHP vulnerabilities?Two critical PHP vulnerabilities disclosed in October 2026 have been rated as 9.2 on the CVSS scale. They may allow remote code execution across much of the web. Cybersecurity specialists have urged organizations to patch quickly.
How is AI being used in cyberattacks?AI agents can help scan targets, identify vulnerabilities, and implement attack techniques. Recent attacks have shown agents compromising large numbers of websites with little direct human instruction.
Why is intrusion detection becoming more important?AI can accelerate attacks and allow adversaries to operate across many targets simultaneously. Faster detection gives defenders a better chance of identifying unauthorized changes before an attacker can steal data, establish persistence, or cause further damage.
How can blockchain help with intrusion detection?A public blockchain can store timestamped cryptographic proof of files, access events, and system states. If the underlying data changes later, investigators can compare it with the previously recorded state and establish whether the record has been altered.
What is Sentinel Node?Sentinel Node is a blockchain-based cybersecurity tool developed by Certihash. It monitors network and file integrity, creates hashes of monitored data, and records them on BSV blockchain, enabling changes to be detected and important security events to be preserved on a tamper-proof public ledger.
Related articles
Watch: Digital identity is a core part of Web3—here’s why
frameborder=”0″ allow=”accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share” referrerpolicy=”strict-origin-when-cross-origin” allowfullscreen>
Gavin Lucas is a writer at CoinGeek covering blockchain, digital assets, payments, fintech, iGaming and emerging technology. He has more than a decade of experience in digital publishing, SEO and online media, with particular expertise in blockchain technology, online gambling, digital currencies, and payments. His work has included industry reporting, analysis and interviews across blockchain and iGaming, alongside independent digital publishing projects in the UK.
<!–
Sign up to The Coingeek Newsletter
By Caroline Casey
Subscribe
–>
Click Here For The Original Source.
——————————————————–
