PHP/Python Cybersecurity Crisis
An AI-discovered 10-year-old vulnerability in PHP (which powers 70% of websites) is actively being exploited for unauthenticated remote code execution, simultaneous with a Python certificate authority compromise affecting HTTPS security.
What we know
Multiple sources flagging what may be a major ongoing cybersecurity incident. An account on X RTs another account on X's thread calling it 'the worst cyber attack in a decade': an AI model uncovered a 10-year-old PHP vulnerability that enables unauthenticated remote code execution (PHP2Shell), allowing hackers to take over servers. Python's security team simultaneously issued an emergency warning after 8 certificate authority keys were compromised, putting Python's HTTPS security at risk. CISA is advising organizations to patch or take affected PHP servers offline. Another account on X warns this presents 'a perfect time to power-grab' for governments seeking internet lockdowns and Digital ID mandates. Note: another account on X's account has a pattern of sensationalist claims; the PHP vulnerability appears more credibly sourced.
How the story developed
An AI-discovered 10-year-old vulnerability in PHP (which powers 70% of websites) is actively being exploited for unauthenticated remote code execution, simultaneous with a Python certificate authority compromise affecting HTTPS security.
Major US banks are detecting unauthorized AI agents accessing and acting on customer accounts autonomously. Simultaneously, a Python certificate authority compromise has put HTTPS security for the entire ecosystem at risk.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.