Photo via Al Jazeera

World leaders warn against security flaw found in PHP computer programming

Read the original at Al Jazeera ↗
Cite

Farooq, U. (2026, October 22). World leaders warn against security flaw found in PHP computer programming. Al Jazeera. https://www.aljazeera.com/news/2026/10/22/world-leaders-warn-against-security-flaw-found-in-php-computer-programming?traffic_source=rss

Dated from the outlet's own feed. Check the original for its byline.

Al Jazeera · collected 2026-10-22 · by Umar Farooq

Quick Summary

World leaders and cybersecurity experts have taken urgent action against newly discovered critical vulnerabilities in the PHP programming language, advising governments worldwide to temporarily take affected websites offline. The United States National Security Agency issued a public warning on Wednesday, while government officials from Germany, France, Belgium, the Netherlands, Finland, and Japan also reported shutting down their sites as precautionary measures. Two specific flaws, collectively named PHP2Shell, were identified by researchers at Wiz (an Alphabet-owned company) and another firm with assistance from AI models. These vulnerabilities allow attackers to execute malicious commands remotely on servers running outdated PHP code without needing passwords or permissions.
Written by AI on 2026-10-22, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

As of October 21, 2026, critical vulnerabilities were discovered in PHP, a widely used web programming language, prompting European and British authorities to recommend that many websites temporarily go dark. This led to several major sites, including government pages in Europe, the BBC, and other organizations like Wikipedia and Pinboard, being taken offline on Wednesday morning as website operators scrambled to apply security updates or risk potential cyberattacks. The vulnerabilities, rated at a critical severity of 9.2 out of 10, could allow hackers to remotely execute code, potentially compromising sensitive data and networks. Reports suggest that up to 70% of the world's websites may be affected by these issues, as PHP underpins large parts of the internet infrastructure. The discovery underscores concerns about the rapid spread of AI in cybersecurity, with some experts calling it "one of the first areas where we are going to see the harmful impact of AI."

Written for “AI-detected PHP Security Flaw” on 2026-11-01, grounded in this article and the 26 other(s) covering the same event.

Story

📰 AI-detected PHP Security Flaw
Technology · 27 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads unscored and hedges 10% of its claims. Each row says how that neighbour differs.
BBC News
Hedges 5 of 41 claims Outlet record 68/100
Euronews
Hedges 3 of 19 claims Outlet record 60/100
Toronto Star
Hedges 1 of 3 claims Outlet record 64/100
ABC News (AU)
Hedges 5 of 27 claims Outlet record 68/100
CBS News
Hedges 0 of 2 claims Outlet record 66/100
Evening Standard
Hedges 6 of 24 claims Outlet record 65/100
Evening Standard
Hedges 3 of 20 claims Outlet record 65/100
Evening Standard
Hedges 1 of 7 claims Outlet record 65/100
Daily Mail
Hedges 8 of 36 claims Outlet record 68/100
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
21
sentences that state something as happening or true
Uncertain
10%
2 of 21 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
60/100
Al Jazeera's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
27
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-22 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

Al Jazeera · 4625 article(s) · 2 correction(s) detected
Running correction rate · 2 correction(s)

Who wrote this

Umar Farooq
18 article(s) here · 1 carrying a prediction
🔮 Earlier this month, authorities worldwide urged website administrators to execute emergency updates after a nonprofit programming foundation flagged critical security flaws that could allow hackers to breach systems.
🔮 Recommended Stories list of 3 items- list 1 of 3Homeland Security Secretary Mullin reiterates Trump threats about elections - list 2 of 3Will ICE agents play a role in the 2026 US midterm elections? - list 3 of 3Dying in ICE custody: Inside one family’s story of heartbreak The letter accused FlokiNET of violating its terms of service by publishing a “stolen” employee dataset and asked it to “remove or disable” the information.
🔮 Officials told the newspaper that the US government would likely provide the Bolsonaro family permanent residency.
🔮 Voting across Brazil begins at 8am (11:00 GMT) and will close at 5pm local time (20:00 GMT), with nearly 160 million citizens eligible to vote for president.
🔮 Organisations like Human Rights Watch and the American Civil Liberties Union (ACLU) have voiced concern that the Trump administration could use ICE to intimidate voters.
🔮 On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately.
🔮 On Sunday, incumbent President Luiz Inacio Lula da Silva will face right-wing Senator Flavio Bolsonaro in the final round of the election.
🔮 When Israeli Foreign Minister Gideon Saar announced on October 8 that Colombia would be moving its embassy to Jerusalem, he made sure to point out how important the development was for his country’s diplomatic narrative, and that it heralded warming relations with Latin American governments.
🔮 That includes people who are seeking asylum in the US, who are supposed to be given a chance to explain dangers they might face in their home country.
🔮 Voting across Brazil will open at 8am (11:00 GMT) and will close at 5pm local time (20:00 GMT), with nearly 160 million citizens eligible to vote for president, governors and federal legislators.
Also by Umar Farooq
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 18 articles by Umar Farooq →

Topics

3Israeli Al Jazeera NSA Wiz the United States National Security Agency

Subjects

NSA ORG · 2× Wiz ORG · 2× 3Israeli NORP · 1× Al Jazeera ORG · 1× France GPE · 1× Germany GPE · 1× Israeli NORP · 1× Ministry of the Interior ORG · 1× the Federal Ministry for Digital Transformation and Government Modernisation ORG · 1× the United States National Security Agency ORG · 1×

Narrative

Authorities in Europe, Asia and other continents have temporarily taken some government websites offline to protect against newly discovered security vulnerabilities in a programming language used to power the vast majority of sites on the internet.
framing: assertive · carried by 1 article(s) · first seen 2026-10-22
🔮 On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately.

Claims (21 extracted, 2 hedged)

Authorities in Europe, Asia and other continents have temporarily taken some government websites offline to protect against newly discovered security vulnerabilities in a programming language used to power the vast majority of sites on the internet. asserted
Authorities → take → internet
On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately. uncertain
they → prompt → websites
-tech firm helped place spyware on Al Jazeera devices - list 3 of 3How Israeli firm’s ‘zero-click’ malware attack poses global security risk asserted
attack → help → risk
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA said in a social media post. asserted
NSA → use → post
In Germany, the Federal Ministry for Digital Transformation and Government Modernisation said it took some websites offline as a preventative measure. asserted
it → say → measure
France’s Ministry of the Interior deactivated the official websites for local administrative offices. asserted
Ministry → deactivate → offices
Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said they had shut down websites to apply a security patch to close the PHP loophole. asserted
they → say → loophole
Even Japanese Prime Minister Sanae Takaichi posted on social media to warn about the PHP risk. asserted
Takaichi → post → risk
Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence (AI) models. asserted
experts → discover → models
Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11. asserted
Researchers → work → August
Wiz, a security firm owned by tech giant Alphabet, reported the second vulnerability on August 24. asserted
Wiz → own → August
Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”. asserted
findings → say → history
The underlying flaws had been present for decades, the firm said, but proving they were exploitable required a chain of steps “at the edge of what human researchers could practically achieve”. uncertain
researchers → underlie → what
AI tools let researchers find vulnerabilities in software by testing more attacks than human programmers can alone. asserted
programmers → let → attacks
Volunteers maintain the PHP programming language, and the nonprofit PHP Foundation said on Wednesday that the flaws were among the most severe it had encountered. asserted
it → maintain → severe
The group urged anyone administering a website to update their code immediately. asserted
group → urge → code
Both flaws rely on accessing parts of memory without proper authorisation and exploiting that access to run malicious code. asserted
flaws → rely → code
The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access. asserted
attacker → mean → password
The PHP Foundation also warned that AI would make such security weaknesses easier to find. asserted
weaknesses → warn → ?
It called on tech companies to mount a coordinated response to avoid major disruptions to online services. asserted
It → call → services
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the foundation said in a statement. asserted
foundation → find → statement
💬Give feedback
🕘History 🎫Support