The boy says: THE BUG WAS OLD. THE FIX CAME FAST.
Wednesday, Oct. 21, 2026 · Afternoon Update
A flaw hidden in PHP for years could let anyone take over most websites that run it.
@OpenAI wrotean open-source programming language used to run an estimated 70% of websites
The takeaway
AI models helped researchers find a flaw that could expose most PHP websites.
@wiz_io wrotea decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet
The takeaway
Security researchers found a decade-old PHP bug that could expose most of the internet.
You're caught up
The posts that drew the most attention in the 4 hours before 12:07 p.m. ET.
Gain since the previous close · Oct 21, 12:36 PM ET · Yahoo Finance
Charts for each, in the Money columnA record of price, not investment advice.
Six times a day: what blew up in AI on X and Reddit, why it caught fire, and what it says about the people building AI.
The boy says: THE BUG WAS OLD. THE FIX CAME FAST.
Afternoon Update, 12:07 p.m. ETCovers 8:07 a.m. to 12:07 p.m. ET
An earlier update. Read the latest
A flaw hidden in PHP for years could let anyone take over most websites that run it.
Published 12:07 p.m. ET by AI Lately
AI RN shows each X post as plain text. X's script loads only when you ask.
Number 1
Lab postOpenAI
@OpenAI on XPosted
OpenAI@OpenAIOpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers,…
OpenAI's AI models helped find a severe flaw in PHP. PHP is a coding language. Millions of websites run on it. About 70 percent of all websites use some PHP. The flaw let a stranger take over almost any PHP site from far away. Experts call this remote code execution. That means a hacker sends commands over the internet. The website then runs those commands like its own code.
OpenAI named its project Patch the Planet. The project pairs AI models with human security experts. Together they search open source code for hidden bugs. Open source means anyone can read that code for free. Security firms Wiz and Calif also worked on this bug. PHP's own team rushed out a fix the same day. Three separate groups found pieces of the same flaw this year.
OpenAI posted the news on X. The post earned 8,599 likes within hours. It drew 380 replies. The story spread past X fast too. It reached 355 points on Hacker News. Readers left 118 comments on that thread. Cloudflare turned on new firewall rules for every customer. That rule covers customers on its free plan as well.
Why did this catch fire? A flaw this old, hitting this many sites, is rare. Most bugs hide in a small corner of code. This one sat in plain sight for fourteen years. People find that fact unsettling and strangely reassuring together.
What does the reach say about the people building AI? OpenAI wants credit for defense work alongside new chatbots. Greg Brockman, OpenAI's president, called this bug one of the worst found in years. Security teams on X echoed him right away. Many sounded relieved that AI caught this flaw before criminals did. That relief, shared so widely, shows how nervous the field still feels about its own tools.
What it says about the people in AI
AI models helped researchers find a flaw that could expose most PHP websites.
Number 2
Viral on X
@wiz_io on XPosted
Wiz@wiz_io🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. pic.twitter.com/B7yEQuhnoS
Wiz is a cloud security firm. It gave a new bug a name today. The name is PHP2Shell. The bug sat inside PHP for over a decade. PHP is the code behind a huge share of the web. Wiz says the bug reaches a severity score of 9.2 out of 10. That score, called CVSS, ranks how easy and damaging a flaw is. A 9.2 sits near the top of that scale.
Wiz posted a short, urgent message on X. The post used the word breaking in capital letters. It said the bug affects 70 percent of the internet. That single line moved fast across security circles. Many readers shared it within minutes.
The post itself earned 300 likes and nine replies. Those numbers sound small next to the story's real reach. Wiz's own report climbed to 355 points on Hacker News. That thread pulled in 118 comments. Engineers argued there about which servers stay exposed longest.
Cloudflare moved quickly once Wiz and OpenAI shared the details. The company switched on firewall rules for every PHP site it protects. PHP's maintainers shipped patched versions the same day. Sites that update fast close the hole. Sites that wait stay open to attack.
Why did this catch fire? A ten-year-old bug reaching most of the web is rare. Readers want proof the fix actually works everywhere.
What does the reach say about the people building AI? Wiz used AI tools to speed up its own hunt for the flaw. A small cybersecurity firm now moves as fast as a major platform. That shift changes who gets to find the internet's worst bugs first. Power to defend the web now spreads past giant companies. A focused team with the right AI tools can beat criminals to the same hole.
What it says about the people in AI
Security researchers found a decade-old PHP bug that could expose most of the internet.
That is AI right now.
The AI posts and threads that drew the most attention in the 4 hours before 12:07 p.m. ET. Newer updates wait in the archive.
Gain since the previous close · Oct 21, 12:36 PM ET · Yahoo Finance
See the charts in MoneyA record of price, not investment advice.