WordPress is among the platforms built on PHP, the programming language affected by two critical security flaws disclosed in October 2026. Credit: Anthony Ryan / CC BY-SA 2.0
Two critical security flaws in PHP, a programming language used by a large share of the world’s websites, were disclosed Oct. 21 after remaining undetected for more than a decade. The flaws could allow hackers to break into vulnerable servers and take control of them. Security agencies urged organizations to update their systems as researchers detected attempts to exploit the weaknesses.
The PHP discoveries are part of a wider wave of cybersecurity incidents that has made October 2026 a particularly turbulent month for the technology sector. Critical software flaws, attacks involving technology providers and weaknesses in digital security systems have emerged in quick succession. The growing number and variety of incidents have led cybersecurity observers to describe the period as Black October.
Artificial intelligence is adding a new dimension to these threats. Researchers are using AI to find software weaknesses that might otherwise take months of manual investigation to uncover. But the technology can also help attackers develop and adapt hacking methods more quickly, narrowing the time organizations have to protect vulnerable systems.
PHP vulnerabilities expose a weakness across the internet
The immediate concern began with PHP, a programming language that operates behind websites and online services. It supports popular platforms such as WordPress and Drupal, as well as millions of independently developed websites.
The two flaws, collectively known as PHP2Shell, could let attackers break into vulnerable servers without a password and run malicious commands. This means that different websites can face the same risk if they rely on vulnerable PHP installations.
In practical terms, a successful attack could allow someone to take control of an affected server without needing an account or password. That access could expose sensitive information, including passwords and digital access credentials, or allow attackers to interfere with the services running on it.
Researchers at cybersecurity company Wiz discovered the weaknesses with assistance from AI tools. According to their Oct. 21 report, the underlying problems had existed for more than a decade, but exploiting them required connecting several weaknesses in the way PHP manages information inside a computer.
The research team used Google’s Gemini models and OpenAI’s GPT technology to examine the code, develop working demonstrations and test possible fixes. Wiz said Gemini 4 Argon made a particularly significant contribution to identifying the vulnerability and developing the exploit.
The researchers demonstrated that the weaknesses could be used against applications running WordPress, Drupal and Joomla. The vulnerabilities received a critical severity rating of 9.2 out of 10.
On Oct. 21, PHP released security fixes for the flaws and urged website operators to update their systems immediately to prevent attackers from taking control of vulnerable servers. Older versions that no longer receive official support require particular attention because they may need vendor-provided fixes or an upgrade.
AI is shortening the time between discovery and exploitation
The PHP incident illustrates why cybersecurity specialists are paying closer attention to AI-assisted research.
Previously, identifying a complicated software weakness and turning it into a working attack could require weeks or months of specialist work. AI models can now help researchers examine large codebases, identify relationships between different weaknesses and test ways to exploit them.
In the PHP investigation, the challenge involved connecting several programming errors to demonstrate how an attacker could move from exposing information inside a server to taking control of it. AI tools helped researchers work through that complexity and adapt their demonstrations to different software environments.
The implications extend beyond this particular incident. Google’s Threat Intelligence Group reported Sept. 30 that monthly software vulnerability disclosures increased from 5,045 in January to 10,740 in August 2026. The average number of vulnerabilities exploited each month also rose from 10.5 in 2025 to 18 during the first eight months of 2026.
Google cautioned that automated vulnerability registrations and changes in reporting practices contributed to the increase in disclosures. The figures therefore do not establish that AI caused every additional discovery or attack.
Nevertheless, cybersecurity professionals are concerned about the shrinking time available to respond. Shane Fry, chief technology officer at RunSafe Security, told Reuters that the fundamental change involves how quickly vulnerabilities can be found and turned into usable attacks.
The same technology can strengthen defenses by helping security teams identify weaknesses before criminals exploit them. The challenge is ensuring that organizations can apply fixes at a comparable speed.
Exploitation attempts put organizations under pressure
The PHP vulnerabilities attracted attention even before their public disclosure. Amazon Web Services (AWS) reported that its threat intelligence systems detected an attempted exploitation on Oct. 17, four days before PHP announced the security updates.
The activity targeted an AWS monitoring system designed to attract and detect suspicious behavior. Amazon could not establish whether the attempt would have succeeded against a real-world system, but the discovery raised questions about how attackers might have obtained information about the vulnerabilities before their public announcement.
On Oct. 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both PHP flaws to its Known Exploited Vulnerabilities catalog, a database used to help organizations prioritize security problems already being exploited.
Three days later, Palo Alto Networks’ Unit 42 reported active exploitation against internet-exposed management interfaces of its PAN-OS firewall products. Researchers said attackers combined the PHP vulnerabilities with a separate Linux weakness to gain deeper control of affected systems.
Unit 42 said approximately 0.02% of its global installed base had internet-facing management interfaces configured and were affected. The company stressed that these interfaces should normally remain restricted to trusted networks.
The distinction matters: This was a confirmed attack against a specific configuration, not evidence that websites worldwide had been compromised.
October’s warnings extend beyond PHP
The PHP discoveries were part of a particularly busy period for cybersecurity teams. In the same week, researchers disclosed vulnerabilities involving Node.js, an alternative technology for running web applications, and Plex, a popular media-streaming platform. Security breaches also affected LiteLLM, an AI gateway, and Railway, a software development platform.
Another significant incident involved Indian digital security company eMudhra. Google, Apple and Microsoft stopped trusting some of its website-security certificates after weaknesses were identified in cryptographic keys used to protect online communications. The company subsequently announced its withdrawal from the global business of issuing those certificates.
The financial sector also faced renewed scrutiny. On Oct. 30, India’s Reserve Bank increased its cybersecurity oversight of lenders following several incidents, including the exposure of data belonging to 3,900 State Bank of India customers and more than 700 unauthorized transfers involving two non-bank lenders, valued at approximately US$2 million, according to a police complaint.
These incidents have different causes and are not all connected to AI. Their significance lies in the range of digital systems affected, from website infrastructure and software development to financial services and the technology that establishes trust between websites and users.
What website owners and users should know
For organizations operating websites, the immediate priority is to establish whether their systems use vulnerable PHP versions and ensure that the appropriate security updates have been installed.
Ordinary website visitors do not need to install PHP themselves. However, people who manage websites, including WordPress sites, should ask their hosting providers whether the underlying PHP installation has been updated. Older software may require additional attention.
The wider lesson is that cybersecurity increasingly depends on the speed of response. AI can help researchers discover flaws that have escaped attention for years, but it can also reduce the effort required to turn technical discoveries into potential attacks.
Black October has brought that challenge into sharp focus. The security of the internet depends not only on finding hidden weaknesses but also on fixing them before attackers can take advantage.
——————————————————-
Click Here For The Original Source.
