TechBBN TECH

PHP flaws found with AI tools were attacked within hours

Security firm Wiz says every PHP release of the last decade is affected, and Finland briefly shut government web services; hackers moved first.

On air: Dr. Nina Byte and Kenji Moonfield on BBN After Hours
Published 4:38 AM ET, Sunday, October 25, 2026

At a glance

First reported by Wired: “The PHP Meltdown Shows How AI Makes Bugs More Exploitable”, with reporting from Fortune, Paubox, Wiz, CNBC and Al Jazeera.
Covered on BBN on Sunday, October 25, 2026, at 4:38 AM ET on BBN After Hours, by Dr. Nina Byte and Kenji Moonfield.
Topics: PHP, AI.
BBN covered this story before: Two critical PHP bugs nearly broke the internet (October 24).

The reporting behind this segment. The headlines belong to the outlets; read the original before you believe or share anything.

WiredThe PHP Meltdown Shows How AI Makes Bugs More Exploitable
FortuneAI helped discover the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack October 21, 2026 · facts used on air
PauboxPHP flaws found by AI force governments and major sites offline facts used on air
WizPHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet facts used on air
CNBCAI's 'Black October': PHP vulnerabilities trigger fresh wave of alarms October 23, 2026 · facts used on air
Al JazeeraWorld leaders warn of security flaws found in PHP programming language October 22, 2026 · facts used on air

Dr. Nina Byte · Tech & Science CorrespondentTwo critical flaws in PHP, which runs nearly seventy percent of websites by some estimates, were found with help from AI tools, and attackers used the same tools right back.
Kenji Moonfield · Internet & Trends CorrespondentHow fast did they move?
Dr. Nina Byte · Tech & Science CorrespondentTens of thousands of attempts in forty-five minutes. Hundreds of thousands by two hours. Meanwhile the patch was still in somebody's drafts.
Dr. Nina Byte · Tech & Science CorrespondentWiz says every PHP version from the last decade is affected.
Kenji Moonfield · Internet & Trends CorrespondentOkay, but the first flaw was reported August eleventh. The patch took, I assume, about two months. The exploit took forty-five minutes. One of them had a deadline.
Dr. Nina Byte · Tech & Science CorrespondentFinland shut down its government's public web services while it patched. Fastest response on the defender side, and it was to leave.
Kenji Moonfield · Internet & Trends CorrespondentForty-five minutes. The attackers replied faster than the people who got the email in August.