Governments and organizations around the world began scrambling on Oct. 21, 2026, to fix a vulnerability in software that runs their websites, a bug that could give hackers access to data and control of websites. The flaw in PHP, the programming language that powers much of today’s web, prompted urgent warnings from the U.S. National Security Agency, cybersecurity agencies and software vendors.
A researcher at Calif, a security research firm, found the flaw in August 2026 using an advanced artificial intelligence model from OpenAI. The firm alerted the nonprofit that manages PHP. However, word of the flaw leaked before the PHP organization released patches for its software, and according to Amazon Web Services officials, hackers began “broadly” attempting to exploit it.