The Aporia · What to know about the AI-detected security bug impacting wide swaths of the internet

What to know about the AI-detected security bug impacting wide swaths of the internet

Read the original at Toronto Star ↗

Cite

APA MLA Chicago

Huamani, K., & Burrows, E. (2026, October 22). What to know about the AI-detected security bug impacting wide swaths of the internet. Toronto Star. https://www.thestar.com/news/world/united-states/what-to-know-about-the-ai-detected-security-hole-impacting-wide-swaths-of-the-internet/article_2f1f6b1d-1a2c-55e5-8e3f-9a9ce8e54c89.html

Dated from the outlet's own feed. Check the original for its byline.

Quick Summary

On Wednesday, security experts warned of critical vulnerabilities in PHP, the programming language that powers about 70% of websites globally. The PHP Foundation and the FBI’s cyber division issued urgent advisories to update or shut down sites immediately due to potential unauthenticated access risks for hackers. This highlights the growing role of AI in detecting such security flaws. Some government services and websites worldwide have experienced disruptions while implementing patches, emphasizing the widespread impact and complexity of addressing these vulnerabilities.

Written locally by qwen2.5:14b on 2026-10-22, using this article's own text rather than the other coverage of the same event (that is the story summary below).

AI analysis runs on qwen2.5:14b, locally

Story summary

As of October 21, 2026, European and British authorities advised numerous websites to go offline temporarily due to critical vulnerabilities in the PHP programming language. This led to several major sites being inaccessible, including parts of Wikipedia and Pinboard, as well as some government services in Finland, the Netherlands, and Canada. The PHP Foundation released emergency patches on Wednesday morning after detecting two severe flaws that hackers could exploit to gain control over servers. With nearly 70% of websites running PHP, experts warned about potential widespread attacks until updates were implemented. Sites like Something Awful forum and Statistics Canada temporarily shut down as a precautionary measure while applying the fixes. The vulnerabilities were discovered using artificial intelligence, but details leaked prematurely, prompting an urgent response from developers to mitigate risks. As of October 22, UK Government officials reported that thirty-two government services were offline amid these cybersecurity concerns, though no large public-facing critical services were affected directly. International cooperation continues between organizations like the National Cyber Security Centre and OpenAI to address potential issues arising from this security breach.

Written for “Critical PHP Security Flaw Affects Websites” on 2026-10-22, grounded in this article and the 20 other(s) covering the same event.

Why this leaning score

This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.

No political leaning scored for article 99732 · logged 2026-10-22

Compared with similar articles

This article reads unscored and hedges 30% of its claims. Each row says how that neighbour differs.

What is PHP and why did it spark a global cyber security scramble? same event · 100%

BBC News · 0.86 cosine similarity

⚖️ leaning not scored 🔴 12% hedged 5 of 41 📰 publisher trust 69

“Both articles describe the identical incident of AI-detected vulnerabilities in PHP leading to a global cyber security response on Wednesday.”

Websites go dark after AI exposes major programming language security flaw same event · 100%

Euronews

⚖️ leaning not scored 🔴 16% hedged 3 of 19 📰 publisher trust 60

“Both articles describe the exact same incident of critical security flaws being discovered in PHP on the same date, prompting worldwide responses from organizations to update or shut down their websites.”

What’s the PHP coding flaw that could pull down 70 percent of the internet? same event · 100%

Al Jazeera

⚖️ leaning not scored 🔴 11% hedged 4 of 36 📰 publisher trust 60

“Both articles describe the critical vulnerabilities in PHP programming language announced on the same day, causing widespread concern and action among website operators.”

Websites down: What is PHP and how has it raised AI hacking fears? same event · 95%

Dawn · 0.87 cosine similarity

⚖️ leaning not scored 🔴 28% hedged 7 of 25 📰 publisher trust 71

“Both articles discuss the discovery of critical security flaws in PHP due to AI, causing widespread concern and actions among organizations on the same day.”

Critical vulnerabilities in commonly used web code spark rush to update systems same event · 95%

NBC News

⚖️ leaning not scored 🔴 15% hedged 2 of 13 📰 publisher trust 95

“Both articles describe the immediate reaction to critical vulnerabilities in PHP that caused widespread concern and actions such as websites going offline, occurring on the same day.”

Government websites go dark as vulnerabilities in programming language send shudder across internet same event · 95%

The Straits Times

⚖️ leaning not scored 🔴 15% hedged 2 of 13 📰 publisher trust 68

“Both articles describe the disclosure of critical vulnerabilities in PHP leading to disruptions on government and other websites, occurring around the same time.”

Some websites go dark as operators address an AI-detected flaw in a web programming language same event · 95%

Toronto Star

⚖️ leaning not scored 🔴 33% hedged 1 of 3 📰 publisher trust 63

“Both articles discuss the same critical vulnerabilities in PHP detected by AI, leading to warnings from FBI and NSA on the same day.”

Major websites in US and Europe go dark as operators race to protect systems from hackers same event · 95%

New York Post

⚖️ leaning not scored 🔴 33% hedged 3 of 9 📰 publisher trust 66

“Both articles describe the identical incident of newly disclosed vulnerabilities in PHP that caused major websites to temporarily go dark as operators took protective measures.”

Canadian government sites among those offline after flaw identified in widely used computer language same event · 95%

CBC News

⚖️ leaning not scored 🔴 11% hedged 2 of 18 📰 publisher trust 74

“Both articles describe the same specific incident of a vulnerability discovered in PHP leading to numerous websites, including Canadian government sites, going offline on the same day to implement fixes.”

World leaders warn against security flaw found in PHP computer programming same event · 95%

Al Jazeera

⚖️ leaning not scored 🔴 10% hedged 2 of 21 📰 publisher trust 60

“Both articles refer to the same security flaw in PHP discovered on Wednesday, prompting warnings from authorities and leading to websites being taken offline.”

How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted

sentences that state something as happening or true

Uncertain

30%

7 of 23 hedged ("reportedly", "may", "according to")

Leaning

not political

takes no side on a contested political question

Publisher signals

63/100

Toronto Star's corrections and hedging, across everything collected from it. Not a measure of accuracy.

Outlets on this story

Technology

Same framing elsewhere

articles that frame the event the way this one does

Analyzed 2026-10-22 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability

Source leaning vs. consistency

Publisher

Toronto Star · 9065 article(s) · 24 correction(s) detected

Running correction rate · 24 correction(s)

2026-10-21

No. 6 Hoosiers try to for rare rebound at Michigan after turning the page on 22-game winning streak

2026-10-19

Driver’s License Suspensions for Court Debt Draw Scrutiny

2026-10-16

Amputations and cancer treatment delays: Lawmakers hear testimony on Mississippi prison healthcare

2026-10-16

UPDATE: Golconda Gold Releases Q3 2026 Production Update at Galaxy

2026-10-08

News Clarification for Oct. 8

2026-10-07

Correction

2026-10-05

Entertainment Correction for Oct. 5

2026-10-03

Tennessee's prisons chief is resigning after failed execution of Christa Pike

2026-09-28

Organizations call for Action to End the Deaths of Indigenous People in Custody

2026-09-27

Police memorial recognizes six officers killed in the line of duty in 2026

2026-09-27

UPDATE: WSP to host Power & Energy-focused investor event virtually only

2026-09-26

News Clarification for Sept. 27

2026-09-26

Former federal public servant seeks better pensions for injured workers

2026-09-25

News Corrections for Sept. 25

2026-09-25

She has not been charged. But the Project South allegations have branded her with a 'scarlet letter'

2026-09-24

Correction

2026-09-23

MULTIMEDIA UPDATE: Smith+Nephew launches the new EVOS™ PELVIC Plating System at the 2026 Orthopedic Trauma Association (OTA) Annual Meeting, expanding the EVOS Plating Platform for pelvic and acetabular fracture management

2026-09-22

Costa Rican man complained of lack of care for diabetes before his death in ICE custody, family says

2026-09-22

Judges' grilling of accused men leads to sex assault and dangerous driving cases being overturned

2026-09-20

Jura Energy Corporation Provides Clarification Regarding Media Reports Concerning Its Petroleum Rights in Pakistan

2026-09-19

New details emerge about Toronto's guns-for-hire and the 'crash-out mission" that sparked the Project South investigation

2026-09-17

UPDATE: Osisko Critical Minerals Corporation Announces C$100 Million Private Placement of Special Warrants

2026-09-17

Alabama set to execute man for pawn shop killings months after his nitrogen gas execution blocked

2026-09-04

Orca Corrects Q3 Quarterly Dividend Announcement

Who wrote this

Kaitlyn Huamani

11 article(s) here · 1 carrying a prediction

🔮 The vulnerabilities opened sites to a host of potential security concerns The official website for PHP and several other organizations and agencies released security advisories Wednesday urging PHP users to patch two critical vulnerabilities or shut down their sites if they couldn’t update them immediately.

2026-10-22 · mixed framing · What to know about the AI-detected security bug impacting wide swaths of the internet

🔮 With host communities across the U.S. turning against their gargantuan data centers, America's technology giants are promising to take fewer taxpayer handouts, keep fewer secrets or shower more money onto the communities willing to allow the server warehouses.

2026-10-22 · assertive framing · Facing pushback on data centers, tech giants are promising hosts more money and fewer secrets

🔮 TikTok will pay the state of Alabama at least $100 million and must implement a slew of safety features for teens in the state as part of a settlement agreement reached just before the case was set to go to trial.

2026-09-26 · assertive framing · TikTok settles lawsuit with Alabama for at least $100 million, will implement safety features

🔮 The filing maintains that mutual pledges among dominant industry rivals ensuring their timeline "should be slower than competition would otherwise produce has an anticompetitive effect on consumers.

2026-09-19 · assertive framing · Lawsuit accuses Anthropic, OpenAI, Google and SpaceXAI of illegal agreement to slow AI

🔮 The lawsuit, which was filed Friday in the U.S. District Court for the Northern District of California, argues that the leading AI companies violated antitrust laws when they agreed to coordinate slowdown efforts, and that doing so would reduce the value consumers get for paid AI subscriptions.

2026-09-19 · mixed framing · Lawsuit says Anthropic, OpenAI, SpaceXAI and Google made illegal agreement on AI slowdown

🔮 It could bring the promise of advances in science and medicine, tech company executives say, but also risks.

2026-09-19 · assertive framing · Will AI models achieve the ability to improve autonomously? Leading labs say the scenario is near

🔮 It could bring the promise of advances in science and medicine, tech company executives say, but also risks.

2026-09-19 · assertive framing · Will AI models achieve the ability to improve autonomously? Leading labs say the scenario is near

Also by Kaitlyn Huamani

Facing pushback on data centers, tech giants are promising hosts more money and fewer secrets

2026-10-22 · The Independent

OpenAI CEO announces new AI agent and avoids mention of security concerns at developer conference

2026-09-29 · Toronto Star

OpenAI says its models engaged with US government websites in new model misbehavior disclosure

2026-09-26 · Toronto Star

TikTok settles lawsuit with Alabama for at least $100 million, will implement safety features

2026-09-26 · Toronto Star

Nothing else under this byline is closely related to this article, so these are simply their most recent.

All 11 articles by Kaitlyn Huamani →

Emma Burrows

5 article(s) here · 1 carrying a prediction

2026-10-22 · mixed framing · What to know about the AI-detected security bug impacting wide swaths of the internet

🔮 WARSAW, Poland (AP) — NATO’s top military commander said the alliance is “ready to fight tonight” if it is attacked, as European officials warn Russia could test NATO’s defenses with increased covert attacks or a limited military incursion.

2026-10-12 · mixed framing · NATO commander says the alliance does not want war but is 'ready to fight tonight'

🔮 Stringer warned that Nato members need to be aware of the “febrile environment” and careful in their response because Putin would like to provoke the alliance into an “overreaction.”

2026-09-23 · assertive framing · Senior Nato commander warns Putin is becoming more cavalier and open to risk as Ukraine war drags on

🔮 Stringer warned that NATO members need to be aware of the “febrile environment” and be careful in their response because Putin would like to provoke the alliance into an “overreaction.”

2026-09-22 · assertive framing · Senior NATO commander warns Putin is becoming more cavalier and open to risk as Ukraine war drags on

🔮 Stringer warned that NATO members need to be aware of the “febrile environment” and careful in their response because Putin would like to provoke the alliance into an “overreaction.”

2026-09-22 · assertive framing · Senior NATO commander warns Putin is becoming more cavalier and open to risk as Ukraine war drags on

Also by Emma Burrows

NATO commander says the alliance does not want war but is 'ready to fight tonight'

2026-10-12 · Toronto Star

Senior Nato commander warns Putin is becoming more cavalier and open to risk as Ukraine war drags on

2026-09-23 · The Independent

Senior NATO commander warns Putin is becoming more cavalier and open to risk as Ukraine war drags on

2026-09-22 · Toronto Star

Senior NATO commander warns Putin is becoming more cavalier and open to risk as Ukraine war drags on

2026-09-22 · The Independent

Nothing else under this byline is closely related to this article, so these are simply their most recent.

Topics

FBI London PHP The PHP Foundation the Royal United Services Institute

Subjects

James Sullivan PERSON · 2× London GPE · 2× The PHP Foundation ORG · 2× the Royal United Services Institute ORG · 2× FBI ORG · 1× Finland GPE · 1× Japan GPE · 1× OpenAI ORG · 1× Wikipedia ORG · 1× the United Kingdom GPE · 1×

Narrative

The vulnerabilities opened sites to a host of potential security concerns The official website for PHP and several other organizations and agencies released security advisories Wednesday urging PHP users to patch two critical vulnerabilities or shut down their sites if they couldn’t update them immediately.

framing: mixed · carried by 1 article(s) · first seen 2026-10-22

2026-10-22 · Toronto Star

What to know about the AI-detected security bug impacting wide swaths of the internet · mixed framing

Claims (23 extracted, 7 hedged)

The language that’s known as the backbone of the internet is now subject to what experts describe as one of the most notable vulnerabilities in recent memory. asserted

experts → know → memory

PHP is a widely used general-purpose scripting language that is geared towards web development, and thus, it powers the vast majority of websites across the world. asserted

it → use → world

When the organization behind the language and the FBI’s cyber division warned on Wednesday of significant vulnerabilities in the language, government agencies, corporations and other organizations were sent into a flurry. asserted

agencies → warn → flurry

The episode also highlights how artificial intelligence is changing the game when it comes to web security. asserted

it → highlight → security

they → open → them

The PHP Foundation, which works to provide transparency and accountability with the language, said the vulnerabilities could be exploited and allow bad actors to get unauthenticated access to sites running PHP. uncertain

actors → work → PHP

This would mean attackers could control a web server remotely without needing a password, said James Sullivan, director of cyber and tech at the Royal United Services Institute in London. uncertain

Sullivan → mean → London

That could allow a hacker to steal data, alter data or use the system as a platform from which to launch other attacks, he said. uncertain

he → allow → attacks

Exposure is vast, and some sites are still down PHP powers about 70% of websites globally, so the possible exposure to vulnerability was immense. The language is free and open-source, which contributes to its prevalence online. asserted

which → contribute → prevalence

PHP is behind the content management systems WordPress and Drupal, which are commonly used by governments for their sites, and MediaWiki, the software that runs Wikipedia. asserted

that → use → Wikipedia

In accordance with the security advisories issued this week, several websites were taken offline to prevent exposure while they fixed the problem. asserted

they → issue → problem

Some websites may still be down because there are multiple patches available for different types of software, and some organizations may still be waiting to receive them. uncertain

organizations → be → them

They also need to be tested to make sure they work. asserted

they → need → ?

The issues may have been lying dormant The vulnerabilities have been known about since at least 2024, according to the PHP Foundation. uncertain

vulnerabilities → lie → Foundation

A security team developed several competing approaches to solutions, but they each had downsides, and it seemed that there wasn’t a practical or concrete way attackers could exploit the vulnerabilities, so progress on a fix stalled, the foundation said. The group took responsibility for not coming up with a fix sooner, saying: “We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.” uncertain

delay → develop → resources

Some experts say the discovery of the vulnerability could have been even earlier than 2024. uncertain

discovery → say → 2024

The AI cat-and-mouse game between attackers and defenders persists Artificial intelligence agents helped uncover the vulnerabilities. asserted

agents → persist → vulnerabilities

In a blog post, OpenAI said it had led a coalition of researchers, security providers and others to address vulnerabilities in PHP over the past two months. asserted

it → say → months

Researchers at Wiz, a cloud security platform, also said they independently used AI to identify the vulnerabilities. asserted

they → say → vulnerabilities

The accessibility of AI means that many organizations big and small now have more advanced ways to proactively and reactively respond to security threats. asserted

organizations → mean → threats

But it also means bad actors have more advanced ways to exploit digital weak points, and at great scale. asserted

actors → mean → scale

James Sullivan, of the Royal United Services Institute in London, said the push-and-pull can be worrisome, but he’s focused on the positive side. asserted

he → say → side

“We’ve actually seen quite a decent use case here where AI can discover some critical vulnerabilities and then the community can come together to remediate them,” he said. asserted

he → see → them