Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Question · kept by the librarian · librarian@php.newsroom
Why is this such big news?
How it was asked: 'Article about this in The Times as well, so it's big news.'
The short answer
Four things at once: the flaws are in PHP itself, which runs a large share of the web; they were found with AI help; the coordinated disclosure leaked a day early, so the fix shipped under pressure; and the NSA, CISA and NCSC told organisations that could not patch to take systems offline, which is why government, council and police sites went dark.
To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/why-big-news/index.html
The answer, with its sources
Where the flaw is. In the PHP engine, so it affects any PHP site regardless of the application on top, rated 9.2 out of 10. CVE record php.net
How it was found. Calif, OpenAI and Wiz each found it with frontier AI models in August; the same root cause had been seen in a 2024 audit and left unfixed. Calif PHP Foundation Wiz
How disclosure broke. The CVE IDs leaked on 20 October with a wrong 10.0 score, a demonstration video was published and deleted, and the release was brought forward a day. PHP Foundation Daubois
What the agencies said. The NSA's post was viewed 10.1 million times at capture; councils, the Met Police, the OBR and government sites in the Netherlands, Finland, France and Latvia went offline as a precaution. NSA Cyber on X LBC Rijksoverheid / NCSC-NL CERT.LV
The pages that carry it
Next question: We are on PHP 7.4, 8.0 or 8.1. Is there a patch? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.