Back Democracynow

Majority of Websites on Internet Left Vulnerable After Critical Security Flaws Are Discovered

Democracynow • October 23, 2026

Cybersecurity experts are warning that millions of websites are in urgent need of a security patch, after critical flaws were discovered in

, the programming language that powers a majority of sites on the internet. The flaw was discovered Tuesday by researchers at the firm Calif using AI tools. It can allow unauthenticated attackers to take control of web servers and to steal sensitive data including passwords. Prominent websites around the world were taken offline Wednesday as programmers raced to patch the flaw — among them, parts of Wikipedia, the

and several national government portals. Some researchers are calling it the most serious vulnerability ever to affect the internet.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 939 sources 73

Extracted Entities

Majority of Websites on Internet Left Vulnerable After Critical Security Flaws Are Discovered

The full story

Extracted Entities

Attack Types (1)

Industries (1)

Platforms (1)