PHP flaws force websites offline worldwide; outlets differ on AI's role in discovery

Government portals, companies and public platforms in Europe, Nepal and other countries took websites offline on October 21 and 22 after two critical vulnerabilities were disclosed in PHP, the scripting language that runs a large share of the world's websites (The Times of India, OnlineKhabar English, The Free Press Journal). PHP developers released emergency security fixes, and national cyber agencies urged organisations to patch immediately or shut sites down until they could (OnlineKhabar English, The Free Press Journal, Down To Earth). Several outlets reported that the flaws were uncovered by artificial intelligence (Ada Derana, Mint, Hindustan Times).

What every report agrees on

All reports describe the same event: two critical flaws in PHP, an open-source server-side scripting language used to process user requests, manage logins and connect websites to databases (Business Today, The Hindu BusinessLine). Outlets put PHP's share of the world's websites at about 70 per cent (Ada Derana, Down To Earth, The Navhind Times), while The Times of India gave about 75 per cent (The Times of India). The Economic Times reported the two flaws were rated 9.2 out of 10 in severity and could allow remote code execution without authentication, risking data theft or system compromise (The Economic Times). Emergency patches were issued (Down To Earth), and agencies including the US National Security Agency told organisations to install updates at once or take systems offline (Hindustan Times). Cyber agencies in Britain, Europe, Japan and Australia issued similar instructions (The Times of India), and government websites in Europe and Nepal went dark (The Economic Times, OnlineKhabar English).

How the left-leaning press told it

Hindustan Times: AI-assisted audit found flaw

Hindustan Times, rated centre-left, led with the discovery itself, reporting that the vulnerabilities were identified through AI-assisted security audits by OpenAI and a security firm in August (Hindustan Times). It reported that the PHP Foundation acknowledged delays in addressing the issues (Hindustan Times). It also carried the official response, noting the NSA's instruction to install updates immediately or take systems offline and its warning that attackers could reach servers and databases (Hindustan Times).

How the right-leaning press told it

The Economic Times and The Times of India: Decades-old flaw, patch scramble

The Economic Times, rated centre-right, ran an explainer attributing the find to security researchers without crediting AI, setting out the 9.2 severity rating, the remote code execution risk, the developers' patches and early attacks reported by Cloudflare and other firms (The Economic Times). The Times of India, also rated centre-right, said the flaws had remained hidden in the codebase for more than a decade and listed the agencies urging updates (The Times of India). That report mentioned AI in a different role, citing experts who warned AI tools could help attackers reverse-engineer the flaw and mount mass attacks on unpatched servers (The Times of India).

How the centre told it

Mint: New phase in cybersecurity

Mint, rated centre, opened with governments and companies shutting down websites after artificial intelligence uncovered the flaws (Mint). It framed the episode as a new phase in cybersecurity in which more powerful AI can surface long-hidden problems, and noted the international advisories that followed (Mint).

What the record shows

The reports do not contradict each other on the AI question so much as divide on emphasis. Ada Derana, Mint, Hindustan Times, Mathrubhumi, OnlineKhabar and The Navhind Times state that artificial intelligence or AI-assisted work uncovered the flaws, with Ada Derana naming Wiz Research among the cybersecurity firms involved and Hindustan Times naming OpenAI and a security firm in an August audit (Ada Derana, Mint, Hindustan Times, Mathrubhumi, OnlineKhabar English, The Navhind Times). Explainer pieces from The Economic Times, The Times of India, Business Today, The Free Press Journal, The Hindu BusinessLine and Down To Earth describe the same flaws as disclosed by developers or researchers and do not credit AI (The Economic Times, The Times of India, Business Today, The Free Press Journal, The Hindu BusinessLine, Down To Earth). No report in this set denies the AI account. Reports also differ on exploitation: The Economic Times said Cloudflare and other firms reported early attacks (The Economic Times), The Times of India said experts warned malicious actors were already exploiting the flaws (The Times of India), and Mathrubhumi described a leak that raised concern that criminals could act before patching (Mathrubhumi). Down To Earth framed the incident around underfunded open-source tools and digital supply chain management rather than the discovery method (Down To Earth).

Drafted by the Alethman engine from 12 independent reports, and checked by an editor before publication. An outlet's side comes from published media-bias ratings (Media Bias/Fact Check, AllSides) or documented ownership, named under the coverage bar; Alethman does not rate outlets itself.