# 【解説】PHPに重大欠陥。混乱続く（三上洋） - Show: 荻上チキ・Session～発信型ニュース・プロジェクト - Published: 2026-10-21 - Canonical: https://podc.club/en/episode/1532201544_17921e0364fb.html - Audio: https://pdst.fm/e/pscrb.fm/rss/p/traffic.megaphone.fm/TBS9644460083.mp3 - Source: Edited from a machine transcript of the first 30 minutes of the episode. Not an official summary. Two critical vulnerabilities rated 9.2 out of 10 have been found in PHP's core program, potentially affecting roughly 70 percent of websites worldwide. After details leaked on an online forum, the PHP project was forced to rush out an emergency patch, releasing it on October 21, 2026 at 23:00 JST. IT journalist Mikami Hiroshi (三上洋) broke down the nature of the flaws, what ordinary users should do, and the growing AI race to find vulnerabilities. ## What this episode answers ### What exactly are the PHP vulnerabilities, and how serious are they? Two vulnerabilities in PHP's core — allowing attackers to execute arbitrary code by forcing data input or causing memory overflows — were rated 9.2 out of 10, effectively the worst on record, and an emergency patch was released at 23:00 JST on October 21, 2026. ### What damage could have occurred if the vulnerabilities had been left unpatched? Attackers could have broken into servers to steal personal information, defaced or deleted files, and launched ransomware attacks that encrypt data and demand payment. ### How should individual users respond to this issue? Ordinary users need do nothing and can wait for service operators to apply the patch; those running WordPress on their own servers must update PHP to the latest version immediately, and any phishing emails exploiting the incident should be ignored. ### Why was the patch released earlier than originally planned? A vulnerability researcher leaked the details on an online forum, and after security firms verified and publicly confirmed the flaw was real the information spread rapidly; with the risk of working exploit code being created, the PHP project moved the patch release forward. ### What does it mean that AI systems are now competing to discover vulnerabilities? After Anthropic demonstrated that AI could discover large numbers of vulnerabilities, Google and OpenAI followed suit — OpenAI's AI found this particular PHP flaw — accelerating AI adoption on both the offensive and defensive sides of cybersecurity. ## Article ## What PHP Is and Why This Vulnerability Is So Serious PHP is a server-side programming language that powers the back end of roughly 70 percent — in some estimates as high as 80 percent — of websites around the world. It is, in effect, the hidden infrastructure of the internet, which is why a serious flaw in its core carries such broad consequences. On October 21, 2026, the PHP security team announced that two extremely critical vulnerabilities had been discovered and released an emergency patch at 23:00 JST the same day. The flaws were rated 9.2 out of 10 on the standard severity scale — effectively the worst ever recorded for PHP. Government agencies and corporations shut down parts of their web services as a precaution against cyberattack. Public institutions in Europe and the United States also took websites offline, and the FBI urged anyone who detected signs of unauthorized access to report it to the bureau. ## Specific Attack Risks and Damage Scenarios The mechanism behind these vulnerabilities is that an attacker can force data into PHP's program or cause a memory overflow, enabling the execution of arbitrary code on the target server. If exploited, the range of potential damage is wide: - **Theft of personal information**: User data registered with a service could be stolen. - **File tampering and deletion**: A site could be overwritten with the attacker's own content, such as a manifesto. - **Ransomware attack**: Data could be encrypted and a ransom demanded for its release. Mikami described the flaw as "a weakness that makes it possible to hijack a server or infiltrate it and extract information." ## What Individual Users Should Do For ordinary users, **no direct action is required**. The responsibility for applying the fix lies entirely with website operators, and users simply need to wait for that work to be done. The exception is anyone who runs a WordPress blog or site on their own server. In that case, PHP must be updated to the latest version. Because WordPress has been in wide use for around 15 years, Mikami urged people to check whether they are running their own installation. Users should also be alert to phishing scams riding the wave of the news. Emails claiming that "your site has the PHP vulnerability — please fix it," or messages with infected attachments, have nothing to do with individual users and should be ignored. ## How the Patch Release Got Moved Forward — the Forum Leak Originally, the patch was scheduled to be released alongside the vulnerability disclosure with a more comfortable timeline. That plan changed when the details were leaked on an online forum. The person who posted the leak appeared to be a vulnerability researcher pointing out what they believed was the relevant flaw. But when several security firms independently verified and publicly confirmed that it was a genuine hole, the information spread rapidly. With the risk of exploit code being developed rising sharply, the PHP project — an open-source organization — made the decision to rush the patch out, releasing it at 23:00 JST on October 21. The researcher who originally posted the leak has since faced significant criticism on X. ## The New Landscape: AI Versus AI in Cybersecurity The vulnerability was discovered by OpenAI's AI. Behind that fact lies a broader competition among AI companies to find security flaws first. According to Mikami, Anthropic lit the fuse. Anthropic publicly demonstrated that its AI could discover large numbers of vulnerabilities, while announcing that it would keep the findings private to avoid causing harm — a move that made a strong impression on the industry in what amounted to a kind of promotional statement. Google and OpenAI subsequently launched similar efforts, and this time it was OpenAI's AI that found the PHP vulnerabilities. Mikami warned that "we are entering an era where AI finds the vulnerabilities and AI carries out the attacks." With cyberattacks occurring at speeds and scales beyond human capacity to match, he concluded, defenders will have no choice but to accelerate their own use of AI in response. ## Takeaways - Two PHP vulnerabilities rated 9.2 out of 10 — affecting roughly 70 percent of the world's websites — were patched by an emergency release at 23:00 JST on October 21, 2026. - Ordinary users need take no action, but anyone running WordPress on their own server must update PHP to the latest version immediately. - OpenAI's AI discovered the vulnerabilities, a product of the AI industry's intensifying race to find security flaws — a trend that is pushing cybersecurity toward AI-vs-AI confrontation.