OMITTED

What the news leaves out.

← Omitted front page

AI Discovers Critical PHP Vulnerabilities Prompting Global Alerts

10 sources · updated 2026-10-22
Left 60% Center 30% Right 10%
6 left · 3 center · 1 right

What happened

On Wednesday, the PHP Foundation released patches for two critical vulnerabilities in PHP, a server-side language used by about 69 to 70 percent of websites. Cybersecurity firm Calif, using OpenAI's GPT-5.6 Sol in OpenAI's Patch the Planet program, and independently Google-owned Wiz using AI tools, found the flaws—CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell—which had existed since PHP 5 in 2004 and could allow unauthenticated remote code execution. The U.S. National Security Agency, CERT-EU, the United Kingdom's National Cyber Security Centre, and CISA advised organizations to patch immediately or consider taking internet-facing systems offline; parts of Wikipedia, 4chan, DeviantArt, Pinboard, Something Awful, Pokémon Home, Pokémon Champions, and some Japanese, Dutch, and Finnish government sites went offline as a precaution. OpenAI said researchers identified the bugs before attackers did; Cloudflare's chief technology officer wrote the firm was "seeing early attacks emerging," Patchstack said it had received "reports of active exploitation," and CISA said it had "not observed exploitation of these vulnerabilities as of the time of publication." Wiz said exploiting the issues had previously required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," a barrier it warned large language models had removed.
Sourcing check · Mostly on the record · 10 articles

8 of 10 articles cite a named source for the story. It was on the record from the first report.

What these terms mean and how they're counted
On the record · names a source 8 of 10
On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: OpenAI, Cloudflare CTO, U.S. National Security Agency, Patchstack, Greg Brockman and Dane Knecht
Primary evidence · cites a document or data 3 of 10
Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: security patches, blog post, X post, official warning
Credits another outlet 0 of 10
The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
Unnamed sources 3 of 10
The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this. Here: e.g. “the company said”
How it developed
When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 21, 13:06 UTC by NBC News, naming its source. First document in the first report, from NBC News (security patches).
Not counted 0
Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out

Unpacked

Right-leaning coverage frames the PHP bugs as a looming risk, while left-leaning coverage reports that the warning had already become a shutdown. According to NBC News, European and British authorities recommended websites go offline until they could be patched, with Wikipedia among those that went dark. Right-leaning coverage in the Washington Examiner never mentions any site going offline or any government telling operators to do so, stopping at the claim that the internet "could be vulnerable." Left-leaning coverage in Business Insider describes "internet chaos" from the disclosure. Right-leaning coverage in the Washington Examiner leads with as much as 70% of websites sitting at risk. None of the coverage says how many sites, if any, have actually been breached rather than taken down as a precaution.
Bottom line

The Washington Examiner left readers with a risk warning. NBC News was already reporting that Wikipedia had gone dark after agencies told sites to get off the internet.

The receipts — 5 facts one side's coverage lacks
  • The vulnerability has been present in PHP for roughly 20 years numberin The Verge · absent from right-leaning coverage
  • Exploiting the bug required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve contextin The Verge · absent from right-leaning coverage
  • CISA said it had not observed exploitation of these vulnerabilities as of the time of publication official statementin NBC News · absent from right-leaning coverage
  • Sites running PHP 8.1 or older will not receive an official fix contextin The Verge · absent from right-leaning coverage
  • Cloudflare's chief technology officer said the company was seeing early attacks emerging official statementin NBC News, Business Insider · absent from right-leaning coverage
The Left View
Left-leaning outlets framed the day as sudden internet-scale chaos over a little-known language that quietly runs most of the web, stressing a rush to patch or pull sites down after European and British authorities recommended going offline until a fix was in. They placed OpenAI at the center, quoting its claim that it helped find the vulnerability "before hackers exploited it more severely" and its warning that the same AI "can also help attackers rapidly develop offensive tools and exploits." NBC News and Business Insider repeated OpenAI's line that this was "one of the most impactful security issues in recent memory," while The Verge told ordinary users there was "not much" they could do and walked site owners through hosting and WordPress implications. Coverage also amplified a Microsoft engineer's remark that "I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover" and Japan's prime minister's "urgent request for everyone to take action tonight."
The Right View
The Washington Examiner led on exposure rather than the patch scramble, headlining that "up to 70% of world's websites" could be at risk and reporting that PHP's creators said hackers "could use" the problem "to take control of any website running its software." Citing the Wall Street Journal, it presented PHP2Shell as the most severe security flaw the project has faced in more than a decade, and noted that while artificial intelligence found the bug, "AI could also be used by hackers to easily exploit" it.
Our Take (balanced)
Left-leaning coverage's strongest argument is that AI-assisted research produced a coordinated disclosure and patches for flaws that had been theoretically known but practically out of reach, supported by OpenAI and Wiz working with the PHP Foundation before public release and by CISA's statement that it had not observed exploitation at the time of its advisory. The right-leaning account's strongest argument is the blast radius: maintainers and U.S. intelligence treated takeover of any PHP site as realistic enough to justify taking systems off the internet, with Cloudflare's report of emerging attacks after disclosure as evidence that AI also shortens attackers' timeline. The central unresolved tension is whether this is mainly proof that AI can surface internet-scale holes before they are widely abused, or evidence that once such holes are public the same tools erase the old gap between vulnerable and exploitable faster than operators can patch tens of millions of sites.

10 sources

More stories

The week's bottom lines, in your inbox

One email a week: the five stories that mattered and what they actually mean. Free.