World leaders warn against security flaw found in PHP computer programming

Read the original at Al Jazeera ↗
Cite

Farooq, U. (2026, October 22). World leaders warn against security flaw found in PHP computer programming. Al Jazeera. https://www.aljazeera.com/news/2026/10/22/world-leaders-warn-against-security-flaw-found-in-php-computer-programming?traffic_source=rss

Dated from the outlet's own feed. Check the original for its byline.

Al Jazeera · collected 2026-10-22 · by Umar Farooq

Quick Summary

World leaders and cybersecurity experts have taken urgent action against newly discovered critical vulnerabilities in the PHP programming language, advising governments worldwide to temporarily take affected websites offline. The United States National Security Agency issued a public warning on Wednesday, while government officials from Germany, France, Belgium, the Netherlands, Finland, and Japan also reported shutting down their sites as precautionary measures. Two specific flaws, collectively named PHP2Shell, were identified by researchers at Wiz (an Alphabet-owned company) and another firm with assistance from AI models. These vulnerabilities allow attackers to execute malicious commands remotely on servers running outdated PHP code without needing passwords or permissions.
Written locally by qwen2.5:14b on 2026-10-22, using this article's own text rather than the other coverage of the same event (that is the story summary below).

AI analysis runs on qwen2.5:14b, locally

Story summary

As of October 21, 2026, critical vulnerabilities in PHP, a widely-used programming language that powers many websites including WordPress and Wikipedia, have prompted warnings from European and British authorities. Websites such as Pinboard and parts of Wikipedia were temporarily offline to prevent potential hacker attacks. The vulnerabilities carry critical severity ratings of 9.2 out of 10. Government sites in the Netherlands, Finland, and other countries also went dark as a precautionary measure against possible breaches. Major U.S. websites like Something Awful and hospitals, political organizations, and educational platforms worldwide are affected. The FBI, NSA, and cybersecurity firms advise immediate updates or taking vulnerable systems offline to mitigate risks.

Written for “Critical PHP Security Flaw Affects Websites” on 2026-10-22, grounded in this article and the 9 other(s) covering the same event.
Why this leaning score
This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.
No political leaning scored for article 97894 · logged 2026-10-22

Story

📰 Critical PHP Security Flaw Affects Websites
Technology · 10 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads unscored and hedges 10% of its claims. Each row says how that neighbour differs.
Toronto Star
⚖️ leaning not scored 🔴 33% hedged 1 of 3 📰 publisher trust 63
“Both articles report on the same critical vulnerabilities in PHP discovered by authorities, leading to a public warning and advice to take websites offline for security reasons.”
ABC News (AU)
⚖️ leaning not scored 🔴 19% hedged 5 of 27 📰 publisher trust 68
“Both articles describe the same security flaw in PHP discovered on the same day, with similar advice from authorities to take affected websites offline.”
CBS News
⚖️ leaning not scored 🔴 0% hedged 0 of 2 📰 publisher trust 66
“Both articles discuss a security flaw in PHP that prompted actions by authorities and researchers on the same day.”
CBC News
⚖️ leaning not scored 🔴 11% hedged 2 of 18 📰 publisher trust 74
“While both articles discuss the vulnerability in PHP and sites going offline, they describe different aspects of the incident over a span of at least one day, with Article B mentioning actions taken by multiple world leaders and authorities.”
The Straits Times · 0.87 cosine similarity
⚖️ leaning not scored 🔴 15% hedged 2 of 13 📰 publisher trust 68
“While both articles discuss vulnerabilities in PHP leading to government websites being taken offline, they describe occurrences on different days (Wednesday vs. a day after), and ARTICLE B mentions a warning from the NSA which is not present in ARTICLE A.”
The Straits Times
⚖️ leaning not scored 🔴 15% hedged 4 of 26 📰 publisher trust 68
“While both articles discuss security vulnerabilities in PHP affecting government websites, they describe different stages or reports about the incident occurring on different days.”
BBC News · 0.86 cosine similarity
⚖️ leaning not scored 🔴 16% hedged 4 of 25 📰 publisher trust 69
“While both articles discuss a security flaw in PHP and actions taken by governments, they describe different time periods or developments around the incident.”
New York Post
⚖️ leaning not scored 🔴 33% hedged 3 of 9 📰 publisher trust 66
“While both articles discuss the same vulnerability in PHP, they describe different phases or aspects of the incident: Article A reports on immediate actions taken by website operators to protect their systems, while Article B focuses on warnings issued by authorities and government responses.”
NBC News
⚖️ leaning not scored 🔴 15% hedged 2 of 13 📰 publisher trust 95
“While both articles discuss vulnerabilities in PHP and recommend going offline, they describe different phases of the incident with different dates and details.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
21
sentences that state something as happening or true
Uncertain
10%
2 of 21 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
60/100
Al Jazeera's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
10
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-22 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

Al Jazeera · 3660 article(s) · 2 correction(s) detected
Running correction rate · 2 correction(s)

Who wrote this

Umar Farooq
12 article(s) here · 1 carrying a prediction
🔮 On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately.
🔮 On Sunday, incumbent President Luiz Inacio Lula da Silva will face right-wing Senator Flavio Bolsonaro in the final round of the election.
🔮 When Israeli Foreign Minister Gideon Saar announced on October 8 that Colombia would be moving its embassy to Jerusalem, he made sure to point out how important the development was for his country’s diplomatic narrative, and that it heralded warming relations with Latin American governments.
🔮 That includes people who are seeking asylum in the US, who are supposed to be given a chance to explain dangers they might face in their home country.
🔮 Voting across Brazil will open at 8am (11:00 GMT) and will close at 5pm local time (20:00 GMT), with nearly 160 million citizens eligible to vote for president, governors and federal legislators.
🔮 Canada and France will pursue cooperation on energy, defence, space and other sectors, in what their leaders say is a reflection of shared values between the two countries.
🔮 In a later statement, he said that a suicide bomber detonated himself near the Special Branch building, adding that an exchange of fire was underway with Fitna al Khawarij terrorists. “The operation will continue until the complete elimination of Fitna-ul-Khawarij,” the IG was quoted as saying, adding that the police’s morale remained high.
🔮 In a later statement, he said that a suicide bomber detonated himself near the Special Branch building, adding that an exchange of fire was underway with Fitna al Khawarij terrorists. “The operation will continue until the complete elimination of Fitna-ul-Khawarij,” the IG was quoted as saying, adding that the police’s morale remained high. Fitna al Khawarij is a term the state uses for terrorists belonging to the banned Tehreek-i-Taliban Pakistan. At around 3:30pm, police said the clearance operation was “in its final stages”. The statement detailed that seven terrorists had attempted to infiltrate Police Lines after the explosion.
🔮 In a later statement, he said that a suicide bomber detonated himself near the Special Branch building, adding that an exchange of fire was underway with Fitna al Khawarij terrorists. “The operation will continue until the complete elimination of Fitna-ul-Khawarij,” the IG was quoted as saying, adding that the police’s morale remained high.
2026-09-18 · assertive framing · 5 cops among 16 martyred in blast at Kohat Police Lines
🔮 “The blood of the martyrs will not go in vain; terrorists and their facilitators will meet an exemplary, dire fate,” the statement quoted him as saying, adding that he had directed to provide the best medical facilities to the injured.
Also by Umar Farooq
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 12 articles by Umar Farooq →

Topics

3Israeli Al Jazeera NSA Wiz the United States National Security Agency

Subjects

NSA ORG · 2× Wiz ORG · 2× 3Israeli NORP · 1× Al Jazeera ORG · 1× France GPE · 1× Germany GPE · 1× Israeli NORP · 1× Ministry of the Interior ORG · 1× the Federal Ministry for Digital Transformation and Government Modernisation ORG · 1× the United States National Security Agency ORG · 1×

Narrative

Authorities in Europe, Asia and other continents have temporarily taken some government websites offline to protect against newly discovered security vulnerabilities in a programming language used to power the vast majority of sites on the internet.
framing: assertive · carried by 1 article(s) · first seen 2026-10-22
🔮 On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately.

Claims (21 extracted, 2 hedged)

Authorities in Europe, Asia and other continents have temporarily taken some government websites offline to protect against newly discovered security vulnerabilities in a programming language used to power the vast majority of sites on the internet. asserted
Authorities → take → internet
On Wednesday, vulnerabilities in the PHP programming language prompted a rare public warning from the United States National Security Agency (NSA), which advised taking websites offline if they could not be updated immediately. uncertain
they → prompt → websites
-tech firm helped place spyware on Al Jazeera devices - list 3 of 3How Israeli firm’s ‘zero-click’ malware attack poses global security risk asserted
attack → help → risk
“Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities,” the NSA said in a social media post. asserted
NSA → use → post
In Germany, the Federal Ministry for Digital Transformation and Government Modernisation said it took some websites offline as a preventative measure. asserted
it → say → measure
France’s Ministry of the Interior deactivated the official websites for local administrative offices. asserted
Ministry → deactivate → offices
Authorities in Belgium, the Netherlands, Finland and the Czech Republic also said they had shut down websites to apply a security patch to close the PHP loophole. asserted
they → say → loophole
Even Japanese Prime Minister Sanae Takaichi posted on social media to warn about the PHP risk. asserted
Takaichi → post → risk
Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence (AI) models. asserted
experts → discover → models
Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11. asserted
Researchers → work → August
Wiz, a security firm owned by tech giant Alphabet, reported the second vulnerability on August 24. asserted
Wiz → own → August
Wiz said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”. asserted
findings → say → history
The underlying flaws had been present for decades, the firm said, but proving they were exploitable required a chain of steps “at the edge of what human researchers could practically achieve”. uncertain
researchers → underlie → what
AI tools let researchers find vulnerabilities in software by testing more attacks than human programmers can alone. asserted
programmers → let → attacks
Volunteers maintain the PHP programming language, and the nonprofit PHP Foundation said on Wednesday that the flaws were among the most severe it had encountered. asserted
it → maintain → severe
The group urged anyone administering a website to update their code immediately. asserted
group → urge → code
Both flaws rely on accessing parts of memory without proper authorisation and exploiting that access to run malicious code. asserted
flaws → rely → code
The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access. asserted
attacker → mean → password
The PHP Foundation also warned that AI would make such security weaknesses easier to find. asserted
weaknesses → warn → ?
It called on tech companies to mount a coordinated response to avoid major disruptions to online services. asserted
It → call → services
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the foundation said in a statement. asserted
foundation → find → statement
💬Give feedback
🕘History 🎫Support