The PHP Foundation disclosed critical vulnerabilities in PHP on October 21, 2026, after AI tools helped uncover them. Cloudflare reported millions of attempts to exploit the flaws after disclosure, following thousands in the preceding hours; the reported attempts do not establish how many succeeded. The US National Security Agency urged organizations to patch affected systems immediately or take them offline.
The report also describes separate incidents involving Railway customer credentials and API keys and a Quest Diagnostics breach of private patient health data. Security analyst Jonathan Riss said people can reduce their own exposure but cannot prevent compromises of shared infrastructure.
