Article · 22 October 2026

Two critical PHP flaws, found with AI, hit thousands of websites

PHP developers have shipped fixes for two critical vulnerabilities that, according to El País, were detected with AI. The US warns they can open a direct route to a server's file system or database.

Nopubly Newsroom · 22 October 2026 · 2 min read

PHP developers have released updates to fix two critical vulnerabilities in the language. According to El País, the flaws were detected with the help of artificial intelligence and are causing multiple failures on thousands of websites.

The paper adds that the errors could bring down many sites. A fix exists. What is unclear is how many sites have applied it.

The United States has also raised the alarm. According to elDiario.es, the country is warning about PHP vulnerabilities that put web servers at risk. The outlet says the flaws can provide a direct route to the server's file system or database.

The difference matters. A site that goes down is visible and can be repaired. Access to the file system or the database is another matter: that is where a service keeps its files and its data.

One reading: the two outlets describe the same problem from opposite ends. El País looks at the effect, pages going down. elDiario.es looks at the way in, access to the server. And a published patch protects no one until somebody installs it. That step falls to each administrator.

For now it is not stated which US body issued the warning, which AI tool found the flaws, or whether attacks are under way.

What changes for people who use or work with AI

For anyone running a website or server on PHP, the first step is to check which version it uses and apply the published updates. It is routine maintenance, but urgent: the flaws are rated critical.

Agencies and hosting companies have extra work. They need to review their clients' environments and warn those who do not update. That means hours of technical staff time.

There is a legal angle too. If a server's database holds personal data, unauthorised access could trigger notification duties under data protection rules. That would depend on the case, and there is no indication that attacks have taken place.

For security teams, the AI detail carries weight. If El País is right to credit AI with the discovery, code review with these tools can find serious flaws in widely used software. That ability serves those who want to fix such flaws, and it could equally serve those who would want to exploit them.

What to keep in mind

• A patch exists: PHP developers have already released updates, according to El País.
• The risk goes beyond pages going down: elDiario.es refers to access to the file system and the database.
• There are two critical vulnerabilities, and El País links their detection to AI.
• Still unknown: who issued the US warning and whether the flaws are being actively exploited.

Key questions

What happened with PHP?

According to El País, the language's developers have released updates to fix two critical vulnerabilities that cause multiple failures on thousands of websites.

What risk is the United States describing?

According to elDiario.es, the US warns that the flaws can provide a direct route to the server's file system or database.

How were the flaws found?

El País's headline says the vulnerabilities were detected with AI. The available texts do not say which tool was used.

Methodology & corrections: Drafted by Nopubly’s automated newsroom strictly from the verified sources linked above, under our editorial criteria. Spot an error? See our corrections policy or write to contact.