Breaking news

AI Finds Two Critical PHP Security Flaws, Prompting Urgent Website Shutdowns Across Europe

by THEFUTURE.TEAM

October 23, 2026

Artificial intelligence has helped expose two serious security flaws in PHP, the programming language powering much of the internet, prompting organisations across Europe to take websites and digital services offline while they worked to prevent potential attacks.

The vulnerabilities had remained undetected for more than a decade. Advanced AI systems from OpenAI and Google helped turn a suspected weakness into a working exploit, highlighting how quickly AI could accelerate cyber threats.

Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram

Europe Moves To Contain The Risk

The Netherlands took down its DigiD digital identity system, the Overheid.nl government portal and the website of the lower house of parliament. The Port of Rotterdam, hospitals, the country’s five largest political parties and even the Dutch National Cyber Security Centre also took websites offline.

Elsewhere, Finland’s state IT provider Valtori suspended government web services, France’s Interior Ministry placed local administration websites into maintenance mode, and Germany’s federal IT service, ITZBund, took several portals offline.

CERT-EU advised organisations unable to patch immediately to take affected websites offline. The European Commission, ENISA, CERT-EU, Europol and national cyber response teams subsequently urged organisations to act without delay, particularly on internet-facing systems.

Why PHP Matters So Much

Created in the early 1990s, PHP remains one of the web’s most widely used programming languages. Security firm Wiz Research estimates that it runs behind roughly seven in 10 websites, including platforms such as WordPress, Drupal and Joomla.

PHP handles essential functions such as logins, payment processing and content delivery, making vulnerabilities in its code a potential global risk. According to Wiz, every PHP version released over the past decade is affected by at least one of the flaws.

A fix was released on Wednesday. The PHP Foundation urged teams to update immediately to patched versions PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions no longer receive official support and should be considered exposed unless vendors have backported the fix, CERT-EU warned.

Websites and applications, from the Paris police website to a Pokémon sleep tracker, temporarily went offline as developers secured their systems.

How AI Turned A Theory Into A Working Attack

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 in severity, affect PHP’s memory management and error handling. Under specific conditions, an attacker could exploit a memory-limit issue to execute malicious code remotely without logging in.

The PHP Foundation said developers first identified signs of the problem during an external audit in 2024. Although researchers developed a theoretical exploit, progress towards a practical attack path and a fix repeatedly stalled as the small core team weighed the risks. The foundation later called the delay “a structural failure”.

In August, security firm Calif, working on an OpenAI-funded audit of PHP’s source code and using OpenAI’s GPT-5.6 Sol model, reported a working remote attack. OpenAI independently identified the issue that day. Two weeks later, Wiz developed additional attack paths using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and GPT-5.6 Sol.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote.

OpenAI called the discovery “one of the most impactful vulnerabilities in recent memory”, saying AI could now identify security flaws with “internet-scale impact”.

The findings were kept confidential while a fix was prepared. However, the two CVE identifiers appeared on online forums and social media on Tuesday afternoon. PHP brought forward its release by a day, while Calif mistakenly published and then deleted a video demonstrating its proof of concept against multiple targets. Copies quickly spread, according to the PHP Foundation.

“The moment all the information’s out there, people can weaponise it very, very quickly,” Steve Kerrison, a senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP.

Has Anyone Been Hacked Yet?

Taking a website offline does not necessarily mean it has been compromised. Dimitrios Salampasis of Australia’s Swinburne University of Technology said shutdowns can be a responsible precaution while patches are applied.

The PHP Foundation said its security team reviewed the proof-of-concept code circulating after the leak and found no functional exploit at the time of release.

However, Cloudflare reported attack traffic targeting its customers on Wednesday, while CERT-EU warned that the public availability of technical details could encourage attackers to probe vulnerable systems.

Large organisations may patch quickly, but smaller operators could remain exposed for weeks or months. Personal blogs and small business websites could be hijacked to distribute malware, send spam or host malicious content.

The Bigger Risk Goes Beyond The Patch

Even after systems are updated, stolen data could be used in phishing attacks to obtain passwords, payment details and other sensitive information.

Third-party dependencies add another risk: websites may remain exposed if the providers they rely on fail to patch their own systems. “Even though you patched yourself … you’re still unsecure,” said Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney.

The incident also raises questions about the resources behind PHP’s security. The language supports government services, banks and online retailers worldwide, yet its security depends heavily on a relatively small group of foundation-funded developers and volunteers.

AI can identify and demonstrate vulnerabilities faster than ever, but fixing them without disrupting the systems that depend on them still requires experienced engineers and a more resilient approach to software security.

The Future Forbes Realty Global Properties

Europe’s Deadly Summer Heat Exposed The Cost Of A Warming Continent

by THEFUTURE.TEAM

October 23, 2026

Europe experienced its deadliest summer for heat-related deaths on record in 2026, with an estimated 24,400 excess deaths linked to extreme temperatures across 30 countries. Researchers estimate that human-induced climate change was responsible for around 32,000 of the deaths attributed to heat in the study’s broader analysis, accounting for 65% of the total.

The findings highlight the growing public-health consequences of global warming, largely driven by fossil fuel use, as extreme heat becomes more frequent and severe.

Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram

A Summer Of Dangerous Heat

Between June and August, heatwaves pushed temperatures in Western Europe to an average of 2.9°C above the 1991–2020 norm, with some days reaching 12°C above average. Nearly a third of estimated heat-related deaths occurred during a particularly intense heatwave between 17 June and 1 July.

“These numbers are a stark reminder that our hotter, more extreme summers are having an increasingly severe impact on public health,” said Dr Clair Barnes, a researcher at Imperial College London and co-author of the study.

The estimated toll exceeded previous peaks of around 29,000 deaths in summer 2022 and 28,000 in 2003 across the region studied.

How Researchers Estimated The Toll

Researchers modelled the relationship between temperature and mortality across 854 urban areas in the EU, UK, Norway and Switzerland, covering around 40% of the population in the 30 countries studied.

The analysis incorporated temperature records, age, socioeconomic conditions, environmental factors and access to healthcare. By comparing actual temperatures with those expected without human-induced warming, the team estimated the additional deaths attributable to climate change.

Final official mortality figures for summer 2026 are not yet available in many countries, and heat-related deaths are often underreported because their effects can be difficult to identify directly.

Older People Face The Greatest Risk

People aged 85 and over accounted for roughly half of the estimated deaths. However, the impact extended across age groups, with around 800 excess deaths among adults aged 20–44 and approximately 6,000 among people under 65.

Southern Europe experienced the highest mortality burden, reflecting hotter temperatures and other vulnerabilities, including air pollution, limited green space and unequal access to healthcare and heat-alert systems.

Italy, France And Spain Record Highest Toll

Italy recorded an estimated 13,303 heat-related excess deaths, followed by France with 7,268 and Spain with 6,824. Germany recorded around 6,340, while the UK saw an estimated 4,354 deaths.

In the UK, the heat also placed significant pressure on healthcare services. Andrew Hartle, Professor of Practice of Anaesthesia at Imperial College Healthcare, said demand during the summer resembled that of a severe winter virus season.

Cities Urged To Strengthen Heat Protection

Researchers say cities can reduce the risks through climate shelters, external shading and building retrofits, alongside measures to help residents avoid exposure during the hottest hours. Checking on vulnerable people, staying hydrated and following heat alerts are also important.

The researchers stress that adaptation must go hand in hand with reducing fossil fuel use to limit further warming. The findings underline that extreme heat is already a major public-health threat across Europe, with thousands of lives at risk each summer.