AI finds PHP flaws, prompting global website security alerts
Vulnerabilities in a core web programming language could affect 70% of sites worldwide.
AI-assisted coverage comparison, editor-supervised · How this was made

AI finds PHP flaws, prompting global website security alerts
Photograph: abc News (embedded from source)
What this story says
- AI assisted in discovering critical vulnerabilities in the PHP programming language, which underpins approximately 70% of websites globally.
- The FBI has warned that these flaws could enable malicious actors to execute code remotely, posing a significant risk to data and networks.
- Millions of cyberattack attempts have been made since the vulnerabilities were disclosed, prompting governments worldwide to take precautionary measures.
- OpenAI stated that its AI systems identified these vulnerabilities before any malicious actors did, highlighting AI's dual role in cybersecurity.
Who covered it
Percentages are shares of the 59 outlets carrying a published leaning rating. 29 of the 88 outlets we know ran this story carry no rating and are not counted in them. Coverage measured .
Trust
60/100
Craft
65/100
Hype
45/100
88 sources · methodology
Critical security vulnerabilities discovered with the assistance of artificial intelligence in the PHP programming language have prompted urgent action from governments and corporations worldwide. PHP is a foundational language for an estimated 70% of global websites. The FBI issued a warning that the flaws could permit remote code execution by malicious actors, increasing the risk of sensitive data and network compromise. OpenAI, the AI research company, reported that its systems identified these vulnerabilities before attackers did. Since the disclosure, millions of attempts to exploit these security weaknesses have been recorded. As a precaution, governments in Europe and elsewhere have temporarily suspended some websites while security updates are applied.
Disagreement on the timeline of discovery
OpenAI stated that AI appeared to find the vulnerabilities before any attackers did, according to ABC News. The Epoch Times digest notes that millions of attempts to exploit the flaws have already been detected, quoting Shopify CEO Tobias Lutke calling it 'the craziest day in cyber security in a long time.' T&T reports that the PHP2Shell vulnerability escalated within hours, according to Cloudflare. Iefimerida reports that millions of cyberattack attempts were made after the security flaws were revealed.
What the coverage left out
None of the right-rated digests mention that OpenAI stated its AI systems identified the vulnerabilities before any attackers did. The digests also do not include details about the specific technical nature of the two critical flaws identified, as reported by ABC News.
Still developing. We have re-checked which outlets are covering this 106 times, most recently on 23 Oct 2026, 19:00, and will add the sides that appear.
How each side covered it
Our own reading of the reporting listed below, written from the outlets’ articles rather than quoted from them. The reasoning is set out on our methodology page.
Left
16 rated outlets
- ABC News led with the urgency of patching the AI-discovered vulnerability, stating it could impact 70% of websites worldwide. The report detailed the FBI's warning about remote code execution risks and quoted James Sullivan, Director of Cyber and Tech at the Royal United Services Institute, who described the flaws as 'staggering' and noted their age. It also included comments from OpenAI about AI's role in both finding and potentially fixing such issues, and mentioned government responses in the UK, Finland, and Japan. The outlet highlighted that AI appeared to find the vulnerabilities before attackers did.
Centre
28 rated outlets
- BBC News, Bay News 9, Business Recorder, Daily Journal, France24, Georgia Asian Times, Naver, News 4 JAX, Post Register and RTÉ all led on the AI‑discovered PHP flaws, stating that the vulnerabilities affect roughly 70 % of websites and that governments and corporations worked through the night, with some public services experiencing outages or limited functionality.
- Asia One’s full article added that Cloudflare chief executive Matthew Prince said attempts rose from thousands before the announcement to tens of thousands within minutes and millions thereafter. It also reported Mitsubishi UFJ Financial Group temporarily suspending internet services, China’s industry ministry urging immediate inspections and upgrades, and South Korea raising its private‑sector cyber alert level.
- The digests did not contain the Cloudflare quotation, the Mitsubishi UFJ suspension, the Chinese ministry’s inspection directive, nor South Korea’s alert level change. None of the centre‑rated summaries mentioned any cost estimate for the remediation effort.
Right
15 rated outlets
- The Epoch Times digest highlighted that millions of attempts to exploit the flaws had already been detected, quoting Shopify CEO Tobias Lutke. Iefimerida's digest focused on the global nature of the cyberattack attempts, stating millions were made after the flaws were revealed, and noted that governments in Europe and other parts of the world suspended websites as a precaution. Both right-rated digests mentioned the large number of cyberattack attempts.
Questions about this coverage
- How did the left and right cover AI finds PHP flaws, prompting global website security alerts?
- Of the 59 outlets on this story carrying a published leaning rating, 25% are rated left, 48% are rated centre, 27% are rated right. Those percentages are shares of the rated outlets, not of every outlet that ran it, which was 88. The sections above set out what each side emphasised, in its own terms.
- Is AI finds PHP flaws, prompting global website security alerts left or right?
- Neither side dominates it. Of the 59 rated outlets on this story, 25% are rated left, 48% are rated centre, 27% are rated right, and no side holds the 70% this site would want before calling a field one-sided. A story is not left or right in any case; the outlets that carried it are what carry ratings.
- Is the coverage of AI finds PHP flaws, prompting global website security alerts biased?
- AI finds PHP flaws, prompting global website security alerts is one event reported by 88 outlets, and this page does not rate the story as biased or unbiased. What it publishes is the spread: which outlets ran it, where named rating organisations place each of them on the spectrum, and what each side chose to lead with. A leaning rating describes an outlet's record over time, not this article, and the two should not be run together.
- Which outlets covered AI finds PHP flaws, prompting global website security alerts?
- 88 that we know of, every one of them listed further up this page with a link to its own report and to what we hold on the publisher. Nothing here is a summary of somebody else's summary: the outlets are named so the original reporting can be read.
- What is the PHP programming language and why is it important?
- PHP is a programming language widely used for web development, powering an estimated 70% of websites globally. Its importance lies in its foundational role for countless websites and online services, making vulnerabilities within it a significant concern for global internet security.
- How did AI become involved in discovering these vulnerabilities?
- Artificial intelligence systems were used to assist in discovering critical security flaws within the PHP programming language. OpenAI reported that its AI appeared to identify these vulnerabilities before malicious actors did, highlighting AI's potential role in both uncovering and potentially exploiting security weaknesses.
- What are the potential consequences of these PHP vulnerabilities?
- The vulnerabilities could allow malicious actors to remotely execute code on affected systems, posing a risk of sensitive data theft, network compromise, or using compromised systems for further attacks. Millions of cyberattack attempts have already been recorded since the flaws were revealed.
Read it at the source
88 outlets, grouped by the leaning a published rating gives them. Every headline links to the original; an underlined outlet name opens our profile of that publisher.
Left
16- Things will get ‘a lot worse before they get better’, experts warn amid AI panic (opens The Independent (US) in a new tab)
The Independent (US) — is The Independent (US) biased? Our profile of this outlet
- Cyber Attack Attempts Multiply, While Companies and Governments Rush to Address PHP Vulnerabilities (opens News.ro in a new tab)
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens Sentinel Colorado in a new tab)
Sentinel Colorado — is Sentinel Colorado biased? Our profile of this outlet
- Rush to fix security flaw takes sites briefly offline (opens Arizona Daily Sun in a new tab)
Arizona Daily Sun — is Arizona Daily Sun biased? Our profile of this outlet
- Hacking attempts surge as websites race to patch PHP issues (opens ABC Australia in a new tab)
ABC Australia — is ABC Australia biased? Our profile of this outlet
- "Millions of Hacking Attempts" After AI Discovered Security Holes on the Internet (opens in.gr in a new tab)
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens McAlester News-Capital in a new tab)
McAlester News-Capital — is McAlester News-Capital biased? Our profile of this outlet
- Millions Of Hacking Attempts As Companies, Governments Rush To Patch PHP Flaws (opens HuffPost in a new tab)
Show 8 more
- AI discovered a software vulnerability that could impact 70% of websites worldwide. The rush is on to patch it (opens PBS NewsHour in a new tab)
PBS NewsHour — is PBS NewsHour biased? Our profile of this outlet
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens Daily Record in a new tab)
Daily Record — is Daily Record biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens Rappler in a new tab)
- Websites around the world go dark after critical security flaws exposed (opens The Journal in a new tab)
The Journal — is The Journal biased? Our profile of this outlet
- Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched (opens Wired in a new tab)
- Hackers Already Trying to Exploit Serious PHP Flaw (opens PC Mag in a new tab)
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens ABC News in a new tab)
- Critical security flaw puts most websites at risk as NSA issues warning (opens USA Today in a new tab)
Centre
28- PHP flaws draw millions of exploit attempts as sites go dark (opens BetaNews in a new tab)
- Tech Teams Race Against Time to Patch Massive Flaw Across Global Websites (opens South Florida Reporter in a new tab)
South Florida Reporter — is South Florida Reporter biased? Our profile of this outlet
- How to keep safe online in the wake of AI-supercharged hacking (opens The Japan Times in a new tab)
The Japan Times — is The Japan Times biased? Our profile of this outlet
- Hacking attempts surge as companies, governments rush to patch PHP flaws - BusinessWorld Online (opens bworldonline.com in a new tab)
bworldonline.com — is bworldonline.com biased? Our profile of this outlet
- Five ways to keep safe online in the wake of AI-supercharged hacking (opens Channel News Asia in a new tab)
Channel News Asia — is Channel News Asia biased? Our profile of this outletOpinion
- Millions of Cyberattacks Due to Security Hole Discovered by AI (opens Ara.cat in a new tab)
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens The Express Tribune in a new tab)
The Express Tribune — is The Express Tribune biased? Our profile of this outlet
- Race to patch AI-discovered software flaw that could affect 70% of websites (opens Spectrum News in a new tab)
Spectrum News — is Spectrum News biased? Our profile of this outlet
Show 20 more
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens Georgia Asian Times in a new tab)
Georgia Asian Times — is Georgia Asian Times biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens Business Recorder in a new tab)
Business Recorder — is Business Recorder biased? Our profile of this outlet
- Race to patch AI-discovered software flaw that could affect 70% of websites (opens Spectrum News 13 in a new tab)
Spectrum News 13 — is Spectrum News 13 biased? Our profile of this outlet
- Race to patch AI-discovered software flaw that could affect 70% of websites (opens Bay News 9 in a new tab)
Bay News 9 — is Bay News 9 biased? Our profile of this outlet
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens The Cumberland Times-News in a new tab)
The Cumberland Times-News — is The Cumberland Times-News biased? Our profile of this outlet
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens Post Register in a new tab)
Post Register — is Post Register biased? Our profile of this outlet
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens Daily Journal in a new tab)
Daily Journal — is Daily Journal biased? Our profile of this outlet
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens TelegraphHerald.com in a new tab)
TelegraphHerald.com — is TelegraphHerald.com biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens Reuters in a new tab)
- PHP: Minister says 32 UK government services unavailable due to global cyber-security issue - follow live (opens BBC News in a new tab)
- Urgent race to fix software flaw that could threaten 70 per cent of websites worldwide (opens Jamaica Gleaner in a new tab)
Jamaica Gleaner — is Jamaica Gleaner biased? Our profile of this outlet
- Millions of Hack Attempts in Hours: Governments and Companies Disable Sites Due to PHP Vulnerability (opens ZN.UA Зеркало недели in a new tab)
ZN.UA Зеркало недели — is ZN.UA Зеркало недели biased? Our profile of this outlet
- Asian governments step up cyber defences after PHP flaw (opens Devdiscourse in a new tab)
Devdiscourse — is Devdiscourse biased? Our profile of this outlet
- Millions of hacking attempts as companies and governments rush to fix programming flaw (opens The Globe & Mail in a new tab)
The Globe & Mail — is The Globe & Mail biased? Our profile of this outlet
- Companies and govts step up cyber defences after PHP flaw (opens RTÉ in a new tab)
- Asian governments step up cyber defences after PHP flaw (opens Asia One in a new tab)
- 'Millions' of exploitation attempts since security flaw affecting websites emerged (opens Sky News UK in a new tab)
Sky News UK — is Sky News UK biased? Our profile of this outlet
- Government Guides Major Companies on PHP Security Measures… Considering Emergency Patch Support (opens Naver in a new tab)
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens News 4 JAX in a new tab)
News 4 JAX — is News 4 JAX biased? Our profile of this outlet
- Government and corporate websites go dark as AI exposes critical security flaws (opens France24 in a new tab)
Right
15- Companies and Governments in the World Are Rushing to Correct a Vulnerability that Exposes Them to Millions of Attempts to Attack (opens la Nacion in a new tab)
- Explainer: What is the PHP flaw, why did it affect Irish websites and how was AI involved in finding the vulnerabilities? (opens Irish Independent in a new tab)
Irish Independent — is Irish Independent biased? Our profile of this outlet
- US Cybersecurity Agencies Urge Immediate Fix for Bug Threatening Millions of Websites (opens The Epoch Times in a new tab)
The Epoch Times — is The Epoch Times biased? Our profile of this outlet
- What Is PHP that Caused a "Blackout" on Thousands of Websites Worldwide - Millions of Cyberattack Attempts Were Made - iefimerida.gr (opens Iefimerida in a new tab)
Iefimerida — is Iefimerida biased? Our profile of this outlet
- Australia news LIVE UPDATES: Microsoft CEO alarmed as global critical PHP flaw sees millions of hacking attempts on websites globally (opens Australian Financial Review in a new tab)
Australian Financial Review — is Australian Financial Review biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens Business Times in a new tab)
Business Times — is Business Times biased? Our profile of this outlet
- Rush is on to patch AI-discovered software vulnerability that could impact 70% of websites worldwide (opens The Batesville Daily Guard in a new tab)
The Batesville Daily Guard — is The Batesville Daily Guard biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens Emirates24|7 in a new tab)
Emirates24|7 — is Emirates24|7 biased? Our profile of this outlet
Show 7 more
- Cloudflare logs millions of exploit attempts after PHP vulnerability disclosure (opens news-pravda.com in a new tab)
news-pravda.com — is news-pravda.com biased? Our profile of this outlet
- Governments, companies rush to fix PHP-related flaws (opens Daily Sabah in a new tab)
Daily Sabah — is Daily Sabah biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch flaws (opens Cyprus Mail in a new tab)
Cyprus Mail — is Cyprus Mail biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens The Straits Times in a new tab)
The Straits Times — is The Straits Times biased? Our profile of this outlet
- Simon Campanello: Now Half the Internet Is Rushing to Stop the Hackers (opens Dagens Nyheter in a new tab)
Dagens Nyheter — is Dagens Nyheter biased? Our profile of this outlet
- PHP Vulnerability: Cloudflare Reports Millions of Attacks (opens Handelsblatt in a new tab)
Handelsblatt — is Handelsblatt biased? Our profile of this outlet
- Government Requests Companies to Implement PHP Security Measures... “Considering Emergency Patch Support” (opens 조선일보 in a new tab)
조선일보
Not rated
29- The World Panics, Bank Websites and Tax Offices Suddenly Down Due to PHP (opens SINDOnews.com in a new tab)
SINDOnews.com — is SINDOnews.com biased? Our profile of this outlet
- Governments, Companies Around the World Shut Down Websites Following Cyberattacks (opens Utusan Online in a new tab)
Utusan Online — is Utusan Online biased? Our profile of this outlet
- Millions of hacking attempts as companies, governments rush to patch PHP flaws (opens Fiji Broadcasting Corporation in a new tab)
Fiji Broadcasting Corporation — is Fiji Broadcasting Corporation biased? Our profile of this outlet
- Five ways to keep safe online in the wake of AI-supercharged hacking (opens PressNewsAgency in a new tab)
PressNewsAgency — is PressNewsAgency biased? Our profile of this outletOpinion
- Millions of Hacking Attempts Detected, Banks, Governments in Japan and Europe Affected - Katadata.co.id Technology (opens katadata.co.id in a new tab)
katadata.co.id — is katadata.co.id biased? Our profile of this outlet
- PHP Releases Fixes for Two Critical Flaws as Cloudflare Adds WAF Protections (opens TokenPost in a new tab)
- A Huge Risk Is Brewing Online: The Number of Attack Attempts Rose to Millions in Hours (opens T&T in a new tab)
- ‘I've not seen anything like this in a long, long time’: Millions of hacking attempts recorded and websites taken down as organizations scramble to patch critical PHP vulnerabilities (opens IT PRO in a new tab)
Show 21 more
- PHP Security Flaws / Millions of Hacking Attempts - Alarm for Governments and Companies (opens avgi.gr in a new tab)
- Governments and Companies Fix Failures After Hacker Attacks (opens correiodobrasil.com.br in a new tab)
correiodobrasil.com.br — is correiodobrasil.com.br biased? Our profile of this outlet
- Cybersecurity From Tokyo to Helsinki: The World Disconnects to Close a PHP Fault (opens linfodrome.com in a new tab)
linfodrome.com — is linfodrome.com biased? Our profile of this outlet
- Cloudfare Recorded "Millions" of Attacks on Sites Around the World Due to Vulnerability in PHP - Services on vc.ru (opens vc.ru in a new tab)
- Governments, Firms Shut Websites Over AI-Exposed PHP Flaws (opens tvcnews.tv in a new tab)
tvcnews.tv — is tvcnews.tv biased? Our profile of this outlet
- PHP Developer Urges to Use Patches to Fix Critical Vulnerabilities on Servers (opens 14ymedio.com in a new tab)
14ymedio.com — is 14ymedio.com biased? Our profile of this outlet
- Global Website 'Hacking Emergency': Concerns About 110,000 Domestic Servers Exposed (opens Seoul Shinmun (서울신문) in a new tab)
Seoul Shinmun (서울신문) — is Seoul Shinmun (서울신문) biased? Our profile of this outlet
- Websites taken offline worldwide as operators rush to patch PHP flaws (opens evertiq.com in a new tab)
evertiq.com — is evertiq.com biased? Our profile of this outlet
- Explained: What are the two PHP vulnerabilities behind a global rush to update and why it matters (opens MediaNama in a new tab)
- PHP Cyber Security breaks down as Thousands of Websites have Vulnerabilities Exposed | West Wales Chronicle : News for Llanelli, Carmarthenshire, Pembrokeshire, Ceredigion, Swansea and Beyond (opens West Wales Chronicle in a new tab)
West Wales Chronicle — is West Wales Chronicle biased? Our profile of this outlet
- Millions of Website Hacking Attempts Recorded After Vulnerability Identified in PHP Programming Language (opens روزنامه اطلاعات روز in a new tab)
روزنامه اطلاعات روز
- PHP Vulnerability that Shook the world... Cloudflare CEO Matthew Prince Warned: 'It Multiplied in Seconds' (opens Haber Sitesi ODATV in a new tab)
Haber Sitesi ODATV — is Haber Sitesi ODATV biased? Our profile of this outlet
- Cloudflare chief reveals 'thousands' to 'millions' of hacking attempts within hours - London Tech News (opens London Tech News | londonlovestech.com in a new tab)
- Millions of hacking attempts as governments rush to patch PHP flaws (opens Egyptian Gazette in a new tab)
Egyptian Gazette — is Egyptian Gazette biased? Our profile of this outlet
- Mass Outages Across European Public Infrastructure Ahead of Emergency PHP Patches (opens Hyperight in a new tab)
- Rush to fix program flaws as hacking attempts surge (opens The Queenslander in a new tab)
The Queenslander — is The Queenslander biased? Our profile of this outlet
- Millions of hacking attempts as companies and governments rush to fix programming flaw (opens BizToc in a new tab)
- Government Issues Security Advisories to Major Companies Amid PHP Vulnerability Crisis - National Cyber Security Consulting (opens National Cyber Security in a new tab)
National Cyber Security — is National Cyber Security biased? Our profile of this outlet
- Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched (opens cybernoz.com in a new tab)
cybernoz.com — is cybernoz.com biased? Our profile of this outlet
- Government Takes Emergency Response to PHP Security Vulnerability… Corporate CISOs Begin Response (opens ddaily.co.kr in a new tab)
ddaily.co.kr — is ddaily.co.kr biased? Our profile of this outlet
- Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched (opens IT Security News in a new tab)
IT Security News — is IT Security News biased? Our profile of this outlet
How did this read?
About the coverage, not about the story. We do not ask whether you agree with what happened — we have no honest use for that answer.
