Critical PHP flaws trigger global patching rush, with small businesses urged to act fast

Cybersecurity teams around the world are racing to patch serious vulnerabilities in PHP, a programming language that some estimates say is used by nearly 70% of all websites. The episode is being called "Black October". Researchers at Google's Wiz and the AI firm Calif discovered the flaws in August using advanced AI models from OpenAI and Google. By Tuesday, warnings had spread online and governments and businesses globally were working to contain the fallout.

John Milinovich, a senior director at Figma, wrote on X that several dozen cyber attacks in two days would each have been the worst of an entire year, affecting sectors from government and education to big tech and banks. Jason Clinton, deputy chief information security officer at Anthropic, said the landscape is likely to get "a lot worse" before it improves, and urged security leaders to ask their boards for help with the basics, not AI. He said organisations need to hold on for about 18 months.

Former US Cybersecurity and Infrastructure Security Agency director Chris Krebs told CNBC that large companies can use advanced models to harden their systems, but serious bugs may be harder for small and medium-sized businesses to handle. He advised smaller firms to scan for vulnerabilities constantly, deploy patches as quickly as possible, or take legacy systems offline. He noted that 3% of all critical vulnerabilities ever discovered have been found in the last month.