Emergency fix released for two serious flaws in a common website tool

On October 21, 2026, PHP, a common website tool, released emergency fixes for two serious flaws. They let strangers control a website's server without a password. Agencies in Europe, Australia, Japan, Britain and the U.S. NSA urged immediate updates or taking sites offline. Government websites went offline after AI found the flaws. Security firm Aikido says attacks have begun.