19 stories from 11 sources

PHP vulnerability triggers an internet-wide security scramble

Day’s Recap

Supporting Articles

9:44 PMPYMNTS

Governments and Organizations Take Sites Offline to Patch Web Vulnerability

Summary

Governments and organizations took websites offline or placed them under preventive maintenance after the disclosure of a widespread vulnerability in PHP. The shutdowns were intended to reduce exposure while operators assessed and patched affected systems.

Taking sites offline shows that some operators judged temporary disruption safer than leaving exposed systems

Why it matters

Emergency shutdowns demonstrate how a flaw in common web infrastructure can disrupt services well beyond the systems that run PHP directly.

9:05 PMCNBC

Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond

Summary

Critical vulnerabilities in PHP, a widely used programming language for websites, prompted warnings across the technology industry. Google, OpenAI and Amazon responded as organizations assessed the risk of potential attacks.

The exposure of flaws in a foundational web technology turns a software issue into a

Why it matters

A vulnerability in PHP can affect thousands of websites and organizations through a single widely deployed software layer.

8:10 PMAl Jazeera

World leaders warn of security flaws found in PHP programming language

Summary

Two vulnerabilities were identified in PHP with the help of artificial intelligence, prompting warnings from governments and other leaders. The language supports websites representing roughly 70 percent of the web, making the disclosure unusually broad in scope.

The scale of PHP's deployment makes patching speed the decisive variable, not merely the technical

Why it matters

A flaw in software used across most of the web can create simultaneous exposure for governments, companies and consumers.

2 stories · 2 sources

7:20 PMFinancial Times

Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’

Summary

Researchers using OpenAI and Google AI models identified severe vulnerabilities in software that supports most websites worldwide. The NSA has warned that the flaws pose a critical cybersecurity risk.

AI has shifted vulnerability discovery from a manual research task toward a scalable process that

Why it matters

AI is accelerating the discovery of flaws in infrastructure used across much of the internet.

4:36 PMThe Verge

PHP: The three letters that shut down sites all over the internet today

Summary

Two AI-discovered bugs in PHP contributed to major disruptions affecting sites including 4chan, DeviantArt, and Wikipedia. Because PHP underpins a large share of the web, including many WordPress sites, the vulnerabilities have consequences well beyond any single platform.

The reported outages show how defects in a widely embedded programming language can cascade into

Why it matters

A shared software dependency can turn a local coding flaw into an internet-wide service disruption.

3:04 PMPYMNTS

OpenAI Mobilizes Tech Firms to Fix Widespread Web Vulnerability

Summary

OpenAI coordinated with technology firms over two months to address critical vulnerabilities in PHP, the open-source language used to run websites and web applications. The company described the flaws as among the most consequential security issues in recent memory.

The response shows that a vulnerability in a foundational open-source component can require industry-wide coordination

Why it matters

A flaw in PHP can expose a broad layer of the web, turning patch coordination into a systemic security challenge.

2:48 PMFortune

AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack

Summary

AI tools helped identify a PHP vulnerability that could affect systems supporting as much as 70% of the internet. OpenAI’s GPT-5.6 Sol model played a key role in finding the issue, raising concerns that attackers could use similar tools to exploit it.

The decisive shift is that AI has demonstrated an ability to uncover a high-impact flaw

Why it matters

The vulnerability turns AI into both a defensive discovery tool and a potential force multiplier for cyberattacks.

1:59 PMTechCrunch

PHP Armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internet

Summary

OpenAI and Google's Wiz identified long-standing security vulnerabilities in PHP, demonstrating how AI-assisted research can uncover flaws that have remained in widely used software. The findings also raise concern that attackers could use similar tools to discover and exploit overlooked weaknesses.

The immediate shift is that AI is accelerating vulnerability discovery in foundational software, including code

Why it matters

AI is compressing the time between finding legacy vulnerabilities and turning them into broad infrastructure risk.

2 stories · 2 sources

12:17 PMCNBC

Government websites in Europe and elsewhere go dark as software flaw sparks security scramble

Summary

Websites, including European government portals, went offline after critical vulnerabilities were discovered in PHP, a widely used programming language. Developers released a fix, prompting affected organizations to update their systems.

The immediate risk shifted from software weakness to operational disruption as organizations rushed to patch

Why it matters

A flaw in common infrastructure software can quickly become a public-service outage and a security crisis at the same time.

11:26 AMKrebs on Security

Widespread PHP Flaw May Cause Many Site Outages Today

Summary

Two critical PHP vulnerabilities reportedly affect nearly 70 percent of websites and can give attackers full control of vulnerable servers. Working exploits are available, and organizations are being urged to update as attacks are already occurring.

The combination of broad exposure, public exploits, and active exploitation turns patching into an emergency

Why it matters

The flaw creates a rare convergence of scale, exploitability, and immediate operational risk across the web.

10:59 AMPolygon

The Entire Internet Is Officially In Crisis Mode Today

Summary

A major PHP security breach reportedly puts widely used websites and services, including Spotify and WordPress, at risk. The vulnerability could affect a broad range of internet infrastructure built on PHP.

The decisive shift is that a vulnerability in a foundational web technology can expose many

Why it matters

A flaw in widely deployed backend software can turn a single technical vulnerability into a cross-platform internet security event.

7:49 AMThe Verge

A critical PHP vulnerability may take websites down today

Summary

PHP developers are expected to release patches for two critical vulnerabilities in the widely used programming language. The flaws could disrupt websites and web applications if operators fail to update their systems.

The immediate shift is from vulnerability disclosure to a same-day patching deadline, leaving website operators

Why it matters

Because PHP underpins a large share of the web, flaws in the language can turn a developer-side security issue into a broad internet disruption.

3:40 PMEconomic Times

SBI investigates dark web leak of 3.8 lakh records

Summary

State Bank of India is investigating a suspected data breach after customer information appeared on the dark web. Reports indicate that about 375,000 records were exposed, including 3,897 containing sensitive personal data, while the bank said its core operations remain unaffected.

The suspected exposure shifts the immediate risk from service disruption to identity fraud and targeted

Why it matters

The case shows that a breach can create serious customer harm and regulatory pressure without interrupting a bank's day-to-day services.

7:04 AMFinextra

India's largest bank hit by cyberattack

Summary

State Bank of India has opened an internal investigation into an alleged cyberattack that exposed customers' personal information.

The alleged exposure puts SBI's customers at immediate risk of fraud and follow-on attacks, while

Why it matters

A breach at India's largest bank could affect millions of customers and test the country's expectations for financial-sector cybersecurity.

1:50 PMPYMNTS

Hackers Employ Grok and Claude to Attack LatAm Banks

Summary

A group identified as CyberCartel reportedly used AI agents from several major technology companies to automate cyberattacks against businesses in Latin America, including banks. The findings were attributed to research by cybersecurity firm Straiker.

AI is lowering the labor and coordination required to run attacks against financial targets, even

Why it matters

Attackers' use of commercial AI agents could increase the volume and speed of cybercrime without requiring equally larger hacking teams.

3:00 AMFortune

Powerful new AI models are fueling a growing wave of cyberattacks, experts say

Summary

Experts link increasingly capable AI models to a recent wave of cyber attacks, including hundreds of website breaches, an unprecedented refund from OpenAI, and the theft of banking data from 68,000 people.

AI is lowering the cost and increasing the scale of attacks, allowing criminals to target

Why it matters

More capable AI is turning cybercrime into a faster, more scalable threat for businesses and consumers.

5:37 PMPYMNTS

Booking.com Probe Exposes Travel Fraud Beyond Checkout

Summary

The European Commission's investigation into Booking.com examined scams in which criminals used genuine reservation details, including arrival dates and booking numbers, to send convincing payment demands. Victims were warned that their rooms would be canceled unless they supplied payment information.

The central risk is not a fake booking but the compromise or misuse of real

Why it matters

Verified booking data can now serve as the entry point for payment fraud, extending the attack surface beyond the platform checkout.

11:26 AMPYMNTS

Booking.com Anti-Fraud Practices Face Scrutiny in Europe

Summary

The European Commission opened a formal investigation into whether Booking.com adequately assessed and mitigated risks from fraudulent listings and related scams. Regulators are examining potential violations of the Digital Services Act.

The inquiry raises the compliance stakes for online marketplaces that allow fraud to reach users

Why it matters

European regulators are testing whether platforms must do more than respond to scams after users have already been exposed.

11:38 AMFinextra

BBVA works with Nvidia to boost AI agent security

Summary

BBVA is working with Nvidia to examine how security and governance controls can be built into AI agents during development. The effort focuses on making safeguards part of the design process rather than adding them after deployment.

The partnership treats autonomous AI systems as an engineering and governance problem, not only a

Why it matters

Embedding controls early could reduce the risk and cost of securing AI agents after they enter production.

Make it yours

Build Your First Pass.

Pick your topics, set your cadence, and receive your personalized First Pass in your inbox. It’s that simple!