AI has found a very serious vulnerability in 70% of websites. Are we lucky here? Or will the world end because of it? In fact, AI has almost nothing to do with this story. Humans do, however.

Credits

Thanks to Michael Mullan-Jensen, Evgeny Kuznetsov, Vlad A Gouf, Fadi Mansour, Bennet Piater, Eric and Sir Galteran for supporting this podcast financially and therefore making it possible for me to produce it!

The theme music for the podcast is a track called Fight or Fall by Def Lev. Find out more about the show at fab.industries/podcast — new media, new rules!

Sources

1. A tale of two PHP remote vulnerabilities, Ryan Austin, Calif, 21 October 2026
2. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, Sagi Tzadik et al., Wiz, 21 October 2026
3. Today's PHP Security Release, and How We're Strengthening PHP Security, The PHP Foundation, 21 October 2026
4. Finding and Exploiting a 21-Year-Old Vulnerability in PHP, Ryan Austin, Calif, 1 May 2026
5. PHP Audit Complete!, OSTIF, 10 April 2025
6. PHP memory_limit remote vulnerability, Stefan Esser, Bugtraq, 13 July 2004
7. Exploiting the php <= 4.3.7 memory_limit bug, Bas Alberts, 18 August 2004 (archived copy)
8. Sicherheitsspezialist verlässt resigniert PHP-Security-Team, Daniel Bachfeld, heise online, 13 December 2006
9. PHP Security Specialist (Stefan Esser) Resigns, Darknet, 18 January 2007
10. Long variables in multipart/form-data cause OOM and temp files are not cleaned, jr@coredu.mp, PHP Bug Tracker, 28 November 2019
11. AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack, Emily Forlini, Fortune, 21 October 2026
12. AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk, Robert McMillan, The Wall Street Journal, 21 October 2026
13. A.I. Discovered a Critical Security Flaw Underpinning Websites, Dustin Volz, The New York Times, 21 October 2026
14. Government websites go dark after AI-discovered flaw sparks security scramble, Raphael Satter et al., Reuters, 21 October 2026
15. Wichtige PHP-Updates am 21. Oktober beheben Codeeinschleusung-Schwachstellen, Dr. Christopher Kunz, heise online, 21 October 2026
16. php2shell: Kritische Sicherheitslücken erlauben Codeeinschleusung in PHP, Dr. Christopher Kunz, heise online, 21 October 2026
17. CVE-2026-109618, cve.org, 21 October 2026
18. CVE-2026-109619, cve.org, 21 October 2026
19. Security Advisory 2026-018, CERT-EU, 20 October 2026
20. Version 1.2: PHP - Kritische Schwachstellen bedrohen Webanwendungen weltweit, Bundesamt für Sicherheit in der Informationstechnik, 22 October 2026
21. Patch the Planet: a Daybreak initiative to support open source maintainers, OpenAI, 22 June 2026
22. Websites taken down worldwide as AI reveals critical cyber-security threat, The BBC, 21 October 2026
23. A flaw in PHP is taking down websites. Is the internet at risk?, The BBC, 22 October 2026
24. Websites went down around the world. Did AI stop it getting worse?, The BBC, 22 October 2026
25. Expert explains the PHP bug that could take down 70% of the internet, CBS News, 22 October 2026
26. Websites taken down worldwide over critical PHP vulnerabilities, Deutsche Welle, 22 October 2026
27. Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched, Lily Hay Newman, Wired, 21 October 2026
28. Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, CJ Moses, AWS, 21 October 2026

↵ Back to home