Tech#TRENDING
Two critical PHP bugs nearly broke the internet
CISA urged organizations to patch immediately after fixes landed, while Palo Alto counted over twenty-two million exposed systems; the warning came from a forum post.
The Short: the best minute of this segment, cut vertical for your thumb. More about this Short

At a glance
- First reported by TechCrunch: “PHP-ocalypse: How two critical web bugs almost broke the internet”, with reporting from Unit 42, Palo Alto Networks.
- Covered on BBN on Saturday, October 24, 2026, at 12:35 PM ET on #Trending, by Dale Bearman and Hank Ledger.
- Topics: PHP.
- BBN covered this story before: Governments pull websites offline over PHP flaw (October 23).
The real story
The reporting behind this segment. The headlines belong to the outlets; read the original before you believe or share anything.
- TechCrunchPHP-ocalypse: How two critical web bugs almost broke the internet
- Unit 42, Palo Alto NetworksThreat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23) October 23, 2026 · facts used on air
What BBN said about it

Hank Ledger · Lead AnchorTwo critical bugs in PHP, the programming language behind about seventy percent of the web-facing internet, nearly broke the internet, TechCrunch reports.

Dale Bearman · Chief Skeptic & ContributorBanks, retailers, hospitals and some government agencies took their servers offline to patch.

Dale Bearman · Chief Skeptic & ContributorAmazon says it saw attackers using one bug a week before the fixes even existed.

Hank Ledger · Lead AnchorA week before the fix. And how did the rest of us find out?

Dale Bearman · Chief Skeptic & ContributorA forum post said the flaws would be disclosed on a certain day and rated them a perfect ten.

Dale Bearman · Chief Skeptic & ContributorIts evidence, and I quote the poster, was 'trust me, bro'.

Hank Ledger · Lead AnchorBanks went offline over a stranger saying trust me.

Dale Bearman · Chief Skeptic & ContributorWorse. Researchers first found both bugs in twenty twenty-four, decided nobody could exploit them, and left them unpatched.

Dale Bearman · Chief Skeptic & ContributorPalo Alto counts twenty-two point six million exposed systems.

Hank Ledger · Lead AnchorSo the forum poster was right and the experts were relaxed. Give me the hashtag.

Dale Bearman · Chief Skeptic & ContributorHashtag trustmebro.
More Shorts
All videos →The story so far
- Storm Austen warnings, PHP patch, Raphinha's rise · BBC
- AI Helps Find and Fix Critical Flaw in PHP Before Attackers Do · The New York Times
- PHP flaws found with AI take websites offline worldwide · Japan Today
- AI finds major flaw in PHP before it was patched · BBC
- Governments pull websites offline over PHP flaw · CNBC
- Two critical PHP bugs nearly broke the internet (this story)
From the archive: everything BBN aired on Saturday, October 24, 2026 · the Tech archive · all months


Photo: M. Rehemtulla · CC BY 2.0 · Wikimedia Commons
Photo: Paowee · CC BY-SA 4.0 · Wikimedia Commons
Photo: Mark Warner · CC BY 2.0 · Wikimedia Commons · altered by BBN
Photo: Ingmar Runge · CC BY-SA 3.0 · Wikimedia Commons · altered by BBN, shared under CC BY-SA 3.0
Photo: Océanos y dados · CC0 · Wikimedia Commons · altered by BBN
Photo: CTV Santa Cruz County · CC BY 3.0 · Wikimedia Commons · altered by BBN
