PHP flaw in 70% of websites sparks global patch race

Governments and organizations worldwide began scrambling on Oct. 21, 2026, to fix a critical vulnerability in PHP, the programming language powering roughly 70% of websites, which could allow hackers to access data and control sites. The flaw, found in August 2026 by a researcher using an advanced OpenAI AI model, was reported to PHP's managers, but word leaked before patches were released, prompting "broad" exploitation attempts by hackers, according to Amazon Web Services officials. The vulnerability allows attackers to run unauthorized commands on web servers, gaining full control of unpatched systems. While everyday internet users are unlikely to be directly affected, website managers and hosts must apply patches immediately to protect sensitive data and prevent network breaches.