OpenAI Bug Hunt Triggers Black October Cyber Emergency
Left 50%
Center 50%
Right 0%
2 left · 2 center · 0 right
What happened
On Oct. 21, 2026, maintainers released patches for two critical vulnerabilities in PHP, a server-side language used by roughly 70 percent of websites whose backend is known. OpenAI’s technology helped researchers find the flaws — dubbed php2shell by security firms — which had gone undetected for more than a decade and could have let attackers steal data or take over servers. Dozens of sites, including government websites in the U.K. and Europe, Wikipedia-family properties, and the Internet Archive, were briefly taken offline as a precaution while operators applied the fixes; the outages were not caused by a successful hack. The National Security Agency and Europe’s cybersecurity agency issued alerts, and OpenAI called the discovery one of the most impactful security issues in recent memory.
Sourcing check · Fully on the record · 4 articles
2 of 2 articles cite a named source for the story. It was on the record from the first report.
What these terms mean and how they're counted
- On the record · names a source 2 of 2
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Dan Lorenc, Eylam Milner, OpenAI, National Security Agency and Wiz
- Primary evidence · cites a document or data 1 of 2
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: security patches, blog post
- Credits another outlet 0 of 2
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 2
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 22, 18:01 UTC by Axios, naming its source. First document in the first report, from Axios (security patches).
- Not counted 2
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
ONE-SIDED THIS WEEK.
Only left-leaning outlets have covered this story in the last two days;
Washington Examiner reported it on 2026-10-21.
Omitted — what each side leaves out
Unpacked
Right-leaning outlets had not covered this as of publication, so those readers miss the event entirely. Left-leaning coverage reports that AI found a major security breach in PHP, used by as much as 70 percent of websites. It says government sites in the UK and Europe went down as a precaution while engineers patched, not because a hack had already succeeded. Anyone reading only the silent side would not know a basic layer of the public web was taken offline to close a newly found hole.
Left-leaning coverage leads with an "AI hacking panic" and then walks through password managers, software updates, and multifactor logins. It never names OpenAI as the lab that found the flaws.
How many PHP sites are still running the unpatched code?
Bottom line
Vox put a PHP flaw on as much as 70 percent of websites without naming OpenAI, and right-leaning outlets have not covered the story at all.
The receipts — 4 facts one side's coverage lacks
- PHP is used by as much as 70 percent of websites
- The NSA warned website operators to take sites down if they did not have enough time to patch
- Wiz wrote that the findings rank among the most severe vulnerabilities discovered in PHP
- Two critical PHP flaws could let an attacker take control of a server without legitimate access
The Left View
Outlets covering the story treat it as both a concrete PHP emergency and a wider “Black October” AI-cyber scare. Axios reported that OpenAI’s tools found the bugs before attackers did, that Wiz ranked them among the most severe PHP flaws in software history, and that the NSA told operators to take sites down if they could not patch in time; it also tied the episode to other incidents, including banks detecting unauthorized third-party AI agents in customer accounts. Vox asked how worried readers should be, stressed that the outages were preventative rather than the result of exploitation, and devoted much of its piece to password, update, and multifactor-authentication advice. CBS News headlined the bug as threatening up to 70 percent of the internet.
Our Take (balanced)
The core story is substantive: it rests on named actors (OpenAI, NSA, Wiz, PHP maintainers), a dated patch release, and public advisories, not a single party’s uncorroborated word. Established facts are the disclosure of two critical PHP remote-control flaws, patches on Oct. 21, 2026, precautionary outages, and official alerts; OpenAI says frontier AI found the bugs first, and these sources do not report confirmed mass exploitation. Still incomplete or alleged are the full scale of “Black October,” how many unpatched PHP sites remain exposed, and the separate bank-AI-agent claims. No right-leaning outlet has reported this. Watch next for CVE and vendor write-ups, patch-adoption data, any confirmed exploitation, and further NSA or bank statements.
4 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.