Key facts
- A flaw in the PHP computer programming language was prematurely released, exposing the web to hackers.
- AI tools were used to discover the PHP vulnerabilities.
- Chainguard CEO Dan Lorenc released the information ahead of schedule, citing evidence of exploitation.
- Cloudflare observed millions of attempts to exploit the flaw.
- Amazon's cloud division confirmed the flaw is being broadly exploited.
A critical flaw in the PHP computer programming language, discovered using AI tools, triggered a global cybersecurity emergency on Wednesday, October 23, 2026. The premature release of information about the vulnerability, which underpins an estimated 70% of the web, left systems exposed to hackers and prompted widespread website shutdowns. Chainguard CEO Dan Lorenc acknowledged releasing the information early, citing evidence of exploitation, though this was disputed by others. The incident highlighted the amplified risks posed by AI in discovering and exploiting cyber threats, with experts warning of similar findings increasing sharply.