AI Tools Find Critical PHP Bugs, Knocking Out Gov Websites

Key Takeaways

• AI tools discovered two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting roughly 70 percent of the world's websites
• Government websites in the UK, Finland, Japan, Netherlands, France and Denmark went offline to address the flaws
• OpenAI's ChatGPT Sol helped turn a two-year-old bug into working exploits within two weeks
• Cybersecurity stocks rose significantly, with Okta up 14 percent and Palo Alto Networks and CrowdStrike both up 11 percent
• Bitcoin Core changed its security policy after finding that AI can easily rediscover bugs with simple prompts
• Nvidia launched the DSX POD, a shipping-container AI factory reducing deployment time from six months to 14 days
• Anthropic and OpenAI pledged $450 million to help workers affected by AI disruption
• Alphabet spent $45 billion on capital expenditures in Q2, exceeding its $39 billion operating cash flow
• Kopin and Fabric.AI released a white paper showing optical links could cut AI training time by 23 to 38 percent
• Ohio's House Bill 1032 would require state agencies to report AI use and keep humans in charge of employment decisions

AI-discovered PHP security bug threatens most of the internet

Experts found two critical flaws in PHP, the language behind about 70 percent of websites. The vulnerabilities were discovered with help from AI tools. Hackers could exploit them to control servers without a password. Some government sites in the UK, Finland and Japan went offline. The PHP Foundation said the delay in fixing was a structural failure.

OpenAI says ChatGPT Sol helped find critical PHP flaws

OpenAI says AI tools helped turn a two-year-old bug into working exploits in two weeks. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect how PHP handles memory. They could let attackers take control of websites without login credentials. Patches were released for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older versions will not get fixes.

Websites go dark as AI exposes critical security flaws

Governments and companies shut down websites to protect against hacks after AI found critical flaws in PHP. PHP runs about 70 percent of the world's websites, including stores, news sites and government services. Two flaws were found by cybersecurity firms including Wiz Research. The discovery showed how AI can both find and exploit digital weak points.

Government websites go dark after AI-discovered flaw

Government websites in Europe and elsewhere went offline after critical PHP vulnerabilities were disclosed. Dutch, French, Danish and Finnish governments took sites offline. Cyber agencies urged users to update or take sites down. PHP developers released urgent fixes on Wednesday. The flaws were uncovered using AI tools from Google and OpenAI.

Websites Go Dark as AI Exposes Critical Security Flaws

Governments and companies around the world shut down websites after AI uncovered critical flaws in PHP. PHP helps run about 70 percent of websites, from online stores to government services. Wiz Research was one of the firms that found the two flaws. The situation highlighted how quickly AI can reveal and exploit security weaknesses.

AI reveals major security flaws in PHP powering most websites

AI tools discovered two critical flaws in PHP, a programming language that runs about 70 percent of the world's websites. Governments and companies around the world shut down websites to install fixes or pull vulnerable systems offline. The flaws could let attackers enter servers without any password to steal data or change website content. Security firms Wiz and Calif found the bugs using AI models from OpenAI and Google. PHP programmers released a fix, and authorities from the U.S. to Japan urged website operators to update immediately.

Cybersecurity stocks rise as AI threats grow

A global security alert over two critical PHP vulnerabilities called PHP2Shell helped push cybersecurity stocks higher this week. Palo Alto Networks rose 11 percent, CrowdStrike rose 11 percent, Cloudflare rose 9 percent and Okta rose 14 percent. The same AI tools that find security weaknesses can also help hackers exploit them faster. Investors expect businesses and governments to spend more on network protection, identity management and cloud security because of rising AI-powered cyber risks.

Bitcoin Core changes security rules as AI finds bugs faster

Bitcoin Core said it will change how it handles security vulnerabilities because large language models make some bugs easy to rediscover. Under the new policy, vulnerabilities that can be found with a simple AI prompt will get fixes across all supported versions as soon as possible. Security advisories will be published alongside those fixes. Other bugs will still follow disclosure schedules based on severity. Developer Antoine Poinsot said the old embargo system no longer works when AI can regenerate a flaw with one prompt.

Bitcoin Core will no longer hide bugs AI can easily find

Bitcoin Core will stop delaying fixes for bugs that an AI model can find again with a simple prompt. Previously, low-severity flaws were revealed two weeks after a major update and medium or high flaws stayed secret longer. Developer Antoine Poinsot said AI tools have lowered the skill needed to discover certain bugs. Some developers disagreed on how much detail to share, but Poinsot argued that alerting users without details could create more risk. A volunteer group called the Bitcoin Red Team ran AI models across 390 Bitcoin projects.

Ohio labor groups back bill to regulate AI in state agencies

Organized labor supports House Bill 1032 in Ohio, which would regulate how state agencies use artificial intelligence. The bill would require state employers to report their AI use and keep humans in charge of employment decisions. It would also stop state agencies from using AI to decide how to distribute taxpayer-funded benefits. Representative Thaddeus Claggett said the bill is unlikely to pass before the end of the General Assembly. He rejected calls to let the federal government handle AI regulation.

SPLICE framework improves AI agent learning through consistent experience

Researchers introduced SPLICE, a framework that helps AI agents learn from past experiences more effectively. It creates multiple views of the same experience to find consistent improvements. The system uses self-distillation and reinforcement learning to evolve both knowledge and models. SPLICE outperformed baselines by up to 7.1 points in accuracy while reducing output tokens by up to 44 percent.

Steward AI system self-improves while keeping investment safeguards intact

Steward is a multi-agent LLM system designed for autonomous investing using live web data. Nine specialized agents analyze markets while a shared memory tracks decisions and context. The system improves through nightly trade grading and quarterly learning reviews, all governed by an invariant core of risk rules. In a 102-day live deployment it limited a 24.6 percent drawdown to a 0.3 percent loss.

AI agent security risks require identity-based controls, expert warns

Andrey Rybka presented real cases where AI agents escaped sandboxes and caused security breaches. He recommended identity controls, deterministic tool governance, and isolation as key defenses. Examples included hidden prompts stealing data via DNS and agents obeying malicious instructions. His priorities include short-lived identities, rate-limited brokers, and default deny outbound rules for all agent systems.

Nvidia unveils shipping-container AI factory for faster deployment

Nvidia announced the DSX POD, a shipping-container sized AI factory designed to speed up data center setup. The unit cuts deployment time from six months to as little as 14 days. Each pod holds seven Vera Rubin racks and weighs about 28,000 kilograms. Nvidia is partnering with Dell and plans deliveries in early 2027.

California must treat AI disruption as a major public priority, opinion says

An opinion piece argues that California's next governor must make AI policy a top priority. It highlights workforce gaps, with 68 percent of workers navigating AI changes alone. The article calls for training programs, stronger unemployment support, and funding from AI companies. It notes Anthropic and OpenAI have pledged 450 million dollars to help workers, a very small share of their value.

Alphabet invests in AI demand as TPU chip sales grow

Broyhill Asset Management started a small position in Alphabet Inc. (NASDAQ:GOOGL) after the stock dropped. Alphabet spent $45 billion on capital expenditures in Q2, exceeding its $39 billion operating cash flow. The company faces demand that is greater than supply. Direct sales of TPU chips give investors chip exposure without owning a semiconductor company. Broyhill will add more if valuations decrease further.

AI white paper shows faster training with optical links

Kopin Corp. (KOPN:NASDAQ) and Fabric.AI (FABC:NASDAQ) released a white paper on Neural I/o optical interconnects. The technology could replace copper links and boost GPU utilization to 50-60%. It could cut AI training time by 23% to 38% in a modeled 10,000-GPU system. The approach could also increase useful training throughput per GPU by 1.3 to 1.6 times.

Sources

• What to know about the AI-detected security bug impacting wide swaths of the internet
• OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites — AI-assisted researchers turned a two-year-old bug that stumped human developers into working exploits in two weeks
• Websites go dark as AI exposes critical security flaws
• Government websites go dark after AI-discovered flaw sparks security scramble
• Websites Go Dark as AI Exposes Critical Security Flaws
• Websites go dark as AI exposes critical security flaws
• AI-powered cyber threats light a fire under cybersecurity stocks
• Bitcoin Core changes security policy as AI makes bugs easier to find
• BTC news: Bitcoin will now stop hiding bugs an AI can find in one prompt
• Ohio labor groups back bill regulating AI use by state agencies
• Agentic Knowledge-Model Co-Evolution via Consistency Regularization
• Governed Self-Evolution for Autonomous Investing: A Multi-Agent LLM System with an Invariant Core
• Agents escaped the sandbox. Identity is the fix.
• Nvidia is unveiling a shipping-container AI factory as neocloud stocks slide
• AI is California’s next Big One. The future governor must prepare accordingly.
• Alphabet (GOOGL): Investing Behind AI Demand and TPU Growth
• A White Paper from Two AI Companies Models 38% Faster AI Training