PHP emergency patches issued after AI-discovered vulnerabilities; UpdraftCentral keys used for backdoor attacks

Dev.to leads with technical remediation, focusing on the PHP2Shell/patch details (CVE IDs, severity, version checks) and adds the UpdraftCentral/backdoor key misuse as a second, separate problem.

Inquirer.net emphasizes broad impact and the shutdown of websites worldwide, framing the issue as “AI” exposing critical PHP flaws and highlighting Wiz’s estimated scale of exposure.

The Washington Examiner spotlights the “up to 70%” claim and frames the story as an existential risk from AI-discovered flaws that could let attackers take control.

Semafor concentrates on government actions, noting which European countries took sites offline after developers used AI to find the vulnerability.

Medium frames the event as the specific PHP memory bugs and explains why they matter to governments that pulled sites, tying remediation urgency to the ability to run code before app logic.

The New Stack emphasizes process and timeline, focusing on the AI-discovered flaw and the time it took to develop the fix, while also repeating the “~70% of websites” premise.

South China Morning Post leads with worldwide site shutdowns and uses the “70% of websites” estimate to explain potential reach across consumer and government services.

Medium Technology emphasizes practical takeaways for non-operators, focusing on what matters to everyday users rather than server-side remediation steps.

CBS News foregrounds the scale estimate and adds a curated expert interpretation via a named SentinelOne official, framing the bug as discovered with AI assistance.

Inc42 leads with an investigative “inside vulnerabilities” framing, positioning the pair of critical PHP issues as affecting most of the internet and implying a deeper breakdown to follow.

Engadget emphasizes practical guidance by noting EU and Canadian government websites are taken offline and urging all PHP users to update to the latest patch.

Mother Jones spotlights AI’s role in finding a critical bug and connects the issue to broad swathes of the internet via PHP and major platforms.

The Verge emphasizes the real-world disruption to well-known sites and uses the PHP framing as a way to explain how the vulnerabilities spread widely.

SiliconANGLE leads on organizations scrambling after PHP patches are released, noting security agencies’ urges to shut down affected systems.

Dev.to focuses on the exploit mechanics and affected environments, naming the CVEs and describing the ‘PHP2Shell’ term, what versions fix it, and which web-facing deployment models are affected.

Times of India leads with government and agency warnings across the US, UK and Europe, emphasizing ‘patch or go offline’ messaging and the resulting offline actions.

The Atlantic frames the story with alarmist language, focusing on websites going dark as part of an ‘apocalypse’ narrative.

NDTV highlights ‘PHP2Shell’ as a severe AI-detected alert and uses a prominent commentary framing, placing attention on the headline severity claim about global website risk.

Dark Reading leads with the security industry response, describing remediation efforts after leaked details and reports of exploitation attempts.

The West Australian leads with the government shutdown and stresses the breadth of PHP use (about 75%) in its headline framing.

PerthNow repeats the same government-offline framing and the same approx. 75% figure, echoing the earlier outlet’s emphasis.

Investing.com is presented as a factbox-style roundup, focusing on which websites were taken offline over PHP risks.

The New York Times emphasizes the AI angle—describing that an AI system discovered the vulnerability—and ties it to broader concerns about AI’s effect on cybersecurity.

Newsweek combines operational impacts (services taken offline) with an AI-security-test framing of the PHP2Shell vulnerabilities.

Simon Willison prioritizes a detailed disclosure timeline and explains how leaks, incorrect early details, and circulated proof-of-concept material influenced the accelerated patch process.

Mashable leads with user-oriented impact guidance, outlining which websites and services are affected and noting linked disruptions from organizations going offline.

The Guardian emphasizes global “shutdown” effects and quotes the language’s broad usage, noting government takedowns in multiple European countries.

Winnipeg Free Press foregrounds that some websites go dark and operators address an AI-detected flaw, but the provided summary lacks further specifics.

The Independent leads with an AI-detected flaw narrative and mentions an FBI cyber warning about two critical PHP vulnerabilities.

Times of India emphasizes government portals going offline, attributing discovery to AI tools and stressing rapid targeting of unpatched systems.

The Globe and Mail focuses on an impending advisory for Canadian organizations, framing the story as open-source PHP disclosures requiring preparedness.

Dev.to stresses technical specifics—names for the flaws, CVE identifiers, scoring, and explains that the vulnerable component is the PHP engine affecting many platforms.

Quartz emphasizes patches across versions and mentions Wiz’s claims about affected versions and the broad footprint of PHP.

The Scotsman leads with a local impact example, saying an Edinburgh council website goes offline amid a broader global alert.

Investing.com frames the development as sparking a security scramble, focusing on the broader disruption rather than technical details.

Slashdot frames the story around government websites going dark and includes a quote about stopgap mitigations while urging patching.

Dawn focuses on the scramble across governments in Europe and other regions, quoting experts warning about the risk of widespread compromise.

Deutsche Welle centers on developers saying key patches are available after the global scare and stresses that updating is imperative.

How-To Geek frames the story as broad user-facing disruption (“your favorite websites are down”), while keeping attention on the need for rapid remediation of PHP flaws.

The Jerusalem Post focuses on the global concern triggered by the disclosures, leading with government sites going dark and repeating the emphasis that users should update as soon as a fix is released.

Cyprus Mail leads with worldwide website downtime and the confirmation that updates fixing the two vulnerabilities are live, while referencing an earlier delay in addressing a related issue.

Jamaica Observer (AFP) leads with government and agency shutdowns, then adds details on warnings to patch or take systems offline and notes timing around private reporting and a leak.

Gizmodo leads with a threat-timing angle, stressing expectations of rapid mass attacks after the flaws’ disclosure and describing potential harm to many websites.

Korea Times leads with worldwide disruption and government response, including a reported NSA instruction to patch immediately or pull systems offline, and adds context about a surge in AI-driven disclosures.

Korea Times leads with the knock-on effect for European government sites, tying outages to EU cybersecurity guidance and explaining what PHP is and why it matters.

Mashable leads as an explainer, promising a plain-English “what happened/what to do” guide, keeping attention on audiences needing steps rather than deep vulnerability mechanics.

Vanguard (Nigeria) matches the same major framing as other outlets: government agencies and companies shut down websites after PHP flaws were reported, keeping attention on global operational impact.

NDTV leads with the operational fallout, emphasising that major PHP flaws could affect a wide range of websites, including government services, because PHP underpins popular platforms.

The Next Web leads with the process story, highlighting the PHP Foundation’s account that one flaw was found in 2024 and that resolving the fix took months, making the timeline central.

Nasha Niva leads with a risk/percentage emphasis—70 percent of websites at risk—without additional detail provided in the supplied summary.

The Next Web spotlights the coordinated government-led shutdowns across Europe, framing downtime as a calculated risk management step while patches were pending.

NL Times leads with the practical timeline for recovery, noting a Dutch agency warning that websites may need hours to return after applying the critical PHP security fix.

TechRadar leads with admins preparing for impact, describing two critical RCE flaws and saying a patch is coming imminently.

Decrypt uses a high-emphasis framing, combining the risk (including takeover without passwords), claims of early attacks, and the role of government pullbacks.

Krebs on Security leads with expected outages and the likelihood that exploits are already available or being used, predicting many sites may show errors today.

The Next Web emphasises the rapid emergency patch rollout, highlighting that AI first flagged the bugs and describing their scope as enabling unauthenticated code execution.

Dev.to foregrounds technical specifics, detailing that the vulnerabilities allow unauthenticated RCE and listing patched version numbers for multiple PHP release branches.

Slashdot spotlights anticipated severity and preparedness, drawing on a report about planned emergency patches, a high severity rating, and references to potential widespread impact claims.

Inc. Magazine leads with practical guidance for website owners, stressing the potential scale of impact and what to do immediately after the releases.

Bangkok Post uses a simplified, urgent framing—‘shudders across the internet’—and focuses on developers rushing out two critical fixes and urging immediate updates.

Wired uses a dramatic framing (‘not a drill’), emphasizing the risk of widespread harm if patches are not applied quickly, while describing the two vulnerabilities.

The Record focuses on offline service impact, highlighting that hundreds of websites were taken down as concern grows over the two PHP vulnerabilities.

Bleeping Computer emphasizes the ‘PHP2Shell’ framing, leading with emergency patches and the CVE identifiers associated with the critical RCE flaws.

Globe and Mail leads with government response, emphasizing that government websites are scrambling to protect systems after PHP issued security warnings.

The Hacker News leads with the “PHP2Shell” naming and immediate fallout, emphasizing emergency patches and listing specific fixed PHP versions as exploit attempts begin.

LWN provides the most deployment- and mechanism-focused framing, explaining which server/PHP setups face higher risk and describing RCE paths via OOM corruption and stale global state.

Help Net Security leads with the PHP2Shell label and a direct call to update, using the CVEs and emphasizing unauthenticated remote code execution.

The Wall Street Journal emphasizes severity and urgency, stressing that experts race to patch before attackers exploit it.

Global News (Canada) combines the disclosure with an operational consequence angle, describing websites taking offline over hack fears and repeating the call to update quickly.

Phoronix foregrounds the patch release information, centering the updated PHP version numbers and advising immediate upgrades for the critical code execution flaws.

CyberScoop leads on the impending timeline and urgency, framing the emergency fixes as forthcoming and mentioning a high-risk flaw rating while urging preparation.

The Hindu spotlights warnings from a cyber agency and the possibility of serious intrusions, framing the threat as emerging risk ahead of a fix.

NBC News emphasizes the severity and global authority guidance, centering on recommendations that websites go offline until patched.

The BBC foregrounds instructions from cyber chiefs to apply safety updates or go offline, tying the guidance directly to PHP’s two critical vulnerabilities.

AppleInsider News stresses near-term impact, predicting a rough couple of days, urging fast patching, and mentioning a CVSS 9.2 severity rating.

The Verge frames the situation as time-sensitive, noting patches expected to roll out and describing how the flaws could take websites down.

Jowhar.com highlights the issue as an EU cybersecurity alert, focusing on urgent warnings triggered by newly disclosed PHP flaws.

Informed Clearly takes a procedural approach, presenting a dated release guide with timing and naming two CVSS 9.2 vulnerabilities to fix.

PC Gamer leads with the anticipation of rapid attacks, highlighting web admins bracing for emergency PHP updates soon after release.

TechCentral emphasizes scale and immediacy by reporting that Cloudflare says early attacks have already begun while fixes are rushed out.

The Express Tribune leads with the operational fallout, emphasizing government and European websites going offline and a broader security scramble, while highlighting PHP developers’ call to update quickly after patches.

Infosecurity Magazine leads on timing and process, framing the story around vulnerabilities being leaked ahead of their scheduled patch disclosure.

The Next Web and its framing stress EU guidance that unpatched sites may need to go offline, alongside the cited patch release time.

The Independent concentrates on the warning that some websites may go down, tying it to the cyber agency alert and PHP’s widespread use.

Free Malaysia Today frames the risk as sites going “dark,” combining EU-style warning context with references to speculation about exposure.

Cyprus Mail emphasizes the scale of exposure (“millions of websites”) while repeating the EU guidance to take affected sites offline if patching can’t be done.

RTE News keeps the story tightly on the EU cybersecurity warning for organisations that cannot apply planned fixes.

Rappler stresses the EU warning again and reiterates the broad use of PHP and the speculation about serious cyber intrusions.

Channel NewsAsia’s second item centers on the EU agency guidance about taking websites offline, focusing on the patching constraint rather than broader speculation.

Channel NewsAsia repeats the warning framing about websites potentially going dark as PHP prepares critical fixes, without additional details in the provided summary.

SecurityWeek emphasizes the threat context, highlighting tracked CVEs and warning that leaked critical flaws could be exploited widely.

The Hacker News spotlights an emergency alert framing, citing watchTowr, focusing on remote code execution potential, supported PHP branches, and noting no reported exploitation.

Help Net Security foregrounds administrator preparedness, stressing PHP’s warning, the lack of early technical detail, and that all PHP installations should be assumed at risk until specifics publish.

Provides a brief, general framing that PHP warns about major security flaws and announces an emergency release to fix them.

Ars Technica leads with an impending emergency patch plan while mentioning an unconfirmed report about remote code execution.

LWN centers on the urgency message from PHP, encouraging all PHP users to prepare to upgrade as soon as the release is available.

Bleeping Computer frames the story around leaked information prompting administrators to prepare for emergency updates, while reiterating that the fix targets two critical flaws.