PHP Flaw Sparks Scramble

A critical AI-detected PHP vulnerability prompted global warnings and website shutdowns.

Leans Left

39% left37% center24% right

Updated Oct 22, 3:48pm ET

Both sides, every morning

The day’s biggest stories and how each side covered them. Free.

What happened

Cybersecurity agencies urged PHP users to install emergency fixes immediately after researchers used AI tools to identify two critical flaws that could let attackers run code on affected servers without logging in. The PHP Foundation released the fixes on October 21, earlier than planned, after details became public before the coordinated release. PHP is used by roughly 70% of websites whose server-side language is known, putting a large share of the internet at potential risk. Governments and organizations took services offline while patching, including more than 32 UK government services. Cloudflare said exploit attempts jumped to millions. AWS said the flaws were broadly exploited, while PHP and UK officials said successful breaches were not confirmed.

How each side covered it

From the left

Left-leaning outlets framed the story as a race to protect public-facing systems, with shutdowns cast as caution rather than proof of compromise. The New York Times emphasized operators moving quickly before attackers could overtake them. The Guardian lingered on fragile shared internet foundations and the AI paradox behind finding and exploiting flaws.

From the right

Right-leaning outlets framed the story as an internet-wide emergency, stressing fast patching and the risk of criminal takeover. Breitbart News emphasized the emergency patch and the scramble it forced. Daily Mail cited a minister describing government outages as work on potential cyber-security issues. Washington Examiner cited the PHP Foundation’s warning that AI could help hackers exploit the bug.

Headlines