Skip to the story
All stories

AI finds PHP flaws, prompting global website security alerts

Vulnerabilities in a core web programming language could affect 70% of sites worldwide.

AI-assisted coverage comparison, editor-supervised · How this was made

Published Updated
AI finds PHP flaws, prompting global website security alerts

What this story says

  • AI assisted in discovering critical vulnerabilities in the PHP programming language, which underpins approximately 70% of websites globally.
  • The FBI has warned that these flaws could enable malicious actors to execute code remotely, posing a significant risk to data and networks.
  • Millions of cyberattack attempts have been made since the vulnerabilities were disclosed, prompting governments worldwide to take precautionary measures.
  • OpenAI stated that its AI systems identified these vulnerabilities before any malicious actors did, highlighting AI's dual role in cybersecurity.

Who covered it

Left 25%(16)Centre 48%(28)Right 27%(15)

Percentages are shares of the 59 outlets carrying a published leaning rating. 29 of the 88 outlets we know ran this story carry no rating and are not counted in them. Coverage measured .

Trust

60/100

Craft

65/100

Hype

45/100

88 sources · methodology

Critical security vulnerabilities discovered with the assistance of artificial intelligence in the PHP programming language have prompted urgent action from governments and corporations worldwide. PHP is a foundational language for an estimated 70% of global websites. The FBI issued a warning that the flaws could permit remote code execution by malicious actors, increasing the risk of sensitive data and network compromise. OpenAI, the AI research company, reported that its systems identified these vulnerabilities before attackers did. Since the disclosure, millions of attempts to exploit these security weaknesses have been recorded. As a precaution, governments in Europe and elsewhere have temporarily suspended some websites while security updates are applied.

Disagreement on the timeline of discovery

OpenAI stated that AI appeared to find the vulnerabilities before any attackers did, according to ABC News. The Epoch Times digest notes that millions of attempts to exploit the flaws have already been detected, quoting Shopify CEO Tobias Lutke calling it 'the craziest day in cyber security in a long time.' T&T reports that the PHP2Shell vulnerability escalated within hours, according to Cloudflare. Iefimerida reports that millions of cyberattack attempts were made after the security flaws were revealed.

What the coverage left out

None of the right-rated digests mention that OpenAI stated its AI systems identified the vulnerabilities before any attackers did. The digests also do not include details about the specific technical nature of the two critical flaws identified, as reported by ABC News.

Still developing. We have re-checked which outlets are covering this 106 times, most recently on 23 Oct 2026, 19:00, and will add the sides that appear.

How each side covered it

Our own reading of the reporting listed below, written from the outlets’ articles rather than quoted from them. The reasoning is set out on our methodology page.

Left

16 rated outlets

  • ABC News led with the urgency of patching the AI-discovered vulnerability, stating it could impact 70% of websites worldwide. The report detailed the FBI's warning about remote code execution risks and quoted James Sullivan, Director of Cyber and Tech at the Royal United Services Institute, who described the flaws as 'staggering' and noted their age. It also included comments from OpenAI about AI's role in both finding and potentially fixing such issues, and mentioned government responses in the UK, Finland, and Japan. The outlet highlighted that AI appeared to find the vulnerabilities before attackers did.

Centre

28 rated outlets

  • BBC News, Bay News 9, Business Recorder, Daily Journal, France24, Georgia Asian Times, Naver, News 4 JAX, Post Register and RTÉ all led on the AI‑discovered PHP flaws, stating that the vulnerabilities affect roughly 70 % of websites and that governments and corporations worked through the night, with some public services experiencing outages or limited functionality.
  • Asia One’s full article added that Cloudflare chief executive Matthew Prince said attempts rose from thousands before the announcement to tens of thousands within minutes and millions thereafter. It also reported Mitsubishi UFJ Financial Group temporarily suspending internet services, China’s industry ministry urging immediate inspections and upgrades, and South Korea raising its private‑sector cyber alert level.
  • The digests did not contain the Cloudflare quotation, the Mitsubishi UFJ suspension, the Chinese ministry’s inspection directive, nor South Korea’s alert level change. None of the centre‑rated summaries mentioned any cost estimate for the remediation effort.

Right

15 rated outlets

  • The Epoch Times digest highlighted that millions of attempts to exploit the flaws had already been detected, quoting Shopify CEO Tobias Lutke. Iefimerida's digest focused on the global nature of the cyberattack attempts, stating millions were made after the flaws were revealed, and noted that governments in Europe and other parts of the world suspended websites as a precaution. Both right-rated digests mentioned the large number of cyberattack attempts.

Questions about this coverage

How did the left and right cover AI finds PHP flaws, prompting global website security alerts?
Of the 59 outlets on this story carrying a published leaning rating, 25% are rated left, 48% are rated centre, 27% are rated right. Those percentages are shares of the rated outlets, not of every outlet that ran it, which was 88. The sections above set out what each side emphasised, in its own terms.
Is AI finds PHP flaws, prompting global website security alerts left or right?
Neither side dominates it. Of the 59 rated outlets on this story, 25% are rated left, 48% are rated centre, 27% are rated right, and no side holds the 70% this site would want before calling a field one-sided. A story is not left or right in any case; the outlets that carried it are what carry ratings.
Is the coverage of AI finds PHP flaws, prompting global website security alerts biased?
AI finds PHP flaws, prompting global website security alerts is one event reported by 88 outlets, and this page does not rate the story as biased or unbiased. What it publishes is the spread: which outlets ran it, where named rating organisations place each of them on the spectrum, and what each side chose to lead with. A leaning rating describes an outlet's record over time, not this article, and the two should not be run together.
Which outlets covered AI finds PHP flaws, prompting global website security alerts?
88 that we know of, every one of them listed further up this page with a link to its own report and to what we hold on the publisher. Nothing here is a summary of somebody else's summary: the outlets are named so the original reporting can be read.
What is the PHP programming language and why is it important?
PHP is a programming language widely used for web development, powering an estimated 70% of websites globally. Its importance lies in its foundational role for countless websites and online services, making vulnerabilities within it a significant concern for global internet security.
How did AI become involved in discovering these vulnerabilities?
Artificial intelligence systems were used to assist in discovering critical security flaws within the PHP programming language. OpenAI reported that its AI appeared to identify these vulnerabilities before malicious actors did, highlighting AI's potential role in both uncovering and potentially exploiting security weaknesses.
What are the potential consequences of these PHP vulnerabilities?
The vulnerabilities could allow malicious actors to remotely execute code on affected systems, posing a risk of sensitive data theft, network compromise, or using compromised systems for further attacks. Millions of cyberattack attempts have already been recorded since the flaws were revealed.

Read it at the source

88 outlets, grouped by the leaning a published rating gives them. Every headline links to the original; an underlined outlet name opens our profile of that publisher.

Left

16
Show 8 more

Centre

28
Show 20 more

Right

15
Show 7 more

Not rated

29
Show 21 more

How did this read?

About the coverage, not about the story. We do not ask whether you agree with what happened — we have no honest use for that answer.

PHP Security Flaws | MediaBias News