Critical PHP vulnerabilities trigger global cybersecurity response

Governments, cybersecurity agencies and major organisations around the world have rushed to secure their systems after the discovery of two critical vulnerabilities in PHP, one of the internet’s most widely used web programming languages. The flaws, which had reportedly remained undiscovered for more than a decade, were identified by researchers using advanced artificial intelligence tools and are being described as among the most significant web security issues in recent years.

The vulnerabilities are severe enough that national cybersecurity agencies in the UK, United States, Europe, Australia and Japan urged organisations to apply security updates immediately or consider taking affected systems offline until patches could be deployed. Several organisations, including government websites, public services and media platforms, temporarily restricted access or took systems offline as a precaution.

Security researchers estimate the flaws could potentially affect a vast portion of internet-facing infrastructure, including websites built on popular platforms such as WordPress, Drupal and Joomla. The vulnerabilities could allow attackers to remotely execute malicious code, potentially leading to website compromise, malware deployment and data theft.

While patches have now been released, experts warn that organisations must move quickly to identify vulnerable systems and monitor for signs of attempted exploitation. The incident highlights both the growing role of AI in cybersecurity and the widespread risks associated with vulnerabilities in foundational internet technologies.

Millions of exploitation attempts follow critical PHP vulnerability disclosure

Cybersecurity experts are warning organisations to patch their systems immediately after millions of attempts to exploit recently disclosed PHP vulnerabilities were detected within hours of the flaws becoming public. PHP is one of the world's most widely used web programming languages, powering a significant portion of internet-facing websites and applications.

According to major technology providers, attackers moved quickly to weaponise the vulnerabilities. Cloudflare reported that exploitation attempts surged from thousands before public disclosure to millions within hours, while Amazon Web Services warned that the flaws were already being actively exploited in the wild. Security researchers believe threat actors had been attempting to leverage the vulnerabilities even before details were officially announced.

The seriousness of the flaws prompted government agencies and organisations around the world to take precautionary measures, including temporarily taking websites offline while security updates were applied. Authorities in the UK, United States, Australia and Europe have all urged organisations to deploy the available patches without delay.

Experts warn that the vulnerability could provide attackers with a direct path to compromise web servers, install malware, steal data or disrupt services. With automated attack tools and AI-driven capabilities accelerating exploitation efforts, organisations are being advised to not only patch affected systems but also review logs for signs of compromise and monitor for ongoing malicious activity.

Weak password leads to breach of data linked to thousands of children

UK data protection authorities have reprimanded Ogi Networks Limited (ONL) and Data Cymru after a cyberattack exposed the personal information of approximately 3,300 individuals, most of them children, through an account protected by the password “Password1.”

According to the Information Commissioner’s Office (ICO), attackers exploited a dormant test account known as Test2, which had remained active for more than 12 years without being properly reviewed or removed. The ransomware attack resulted in the theft of 42GB of data and the encryption of almost 183GB of information, affecting projects that support children and families.

Investigators found that both organisations failed to implement adequate cybersecurity controls and did not clearly define responsibility for protecting the affected systems. The ICO said the incident highlights how a single weak password and an unused account can create a significant security risk.

Following the breach, both organisations introduced stronger security measures, including multi-factor authentication (MFA), stricter access controls, regular account reviews, and updated data processing agreements. The incident serves as a reminder of the importance of basic cyber hygiene practices, such as removing dormant accounts, enforcing strong passwords, and regularly auditing user access to reduce the risk of compromise.

Autonomous AI cyberattack agent discovered in the wild

Security researchers have uncovered a sophisticated AI-powered cyberattack agent capable of conducting an entire attack chain without human intervention. The autonomous tool was designed to perform up to 100,000 malicious actions independently, including scanning for vulnerable targets, exploiting security flaws, stealing credentials, deploying cryptocurrency miners and maintaining persistence on compromised systems.

The AI agent was discovered by Symantec’s Threat Hunter Team through an AI honeypot designed to attract attackers targeting artificial intelligence infrastructure. Researchers captured the malware’s instruction set and found that it was engineered to hijack exposed large language model (LLM) services, a technique known as LLMjacking, allowing attackers to use third-party AI resources while avoiding detection and operational costs.

Analysis revealed the agent had access to dozens of offensive tools capable of reconnaissance, vulnerability exploitation, database theft, credential harvesting and botnet management. The instructions also included techniques intended to bypass the safety controls built into commercial AI models and disguise malicious activity as legitimate system administration tasks.

While the individual attack methods are not new, researchers warn that combining them into a self-directed AI agent significantly lowers the barrier to entry for cybercriminals. The discovery highlights a growing shift in the threat landscape, where AI is no longer just assisting attackers but increasingly acting as the engine that plans and drives cyber operations autonomously.

Critical GitLab vulnerability allows remote code execution on self-managed servers

GitLab has released emergency security updates to address a critical remote code execution (RCE) vulnerability tracked as CVE-2026-110264, which carries the maximum CVSS score of 10.0. The flaw affects all self-managed GitLab installations dating back to version 7.0, meaning systems running software released as far back as 2014 may be vulnerable.

According to GitLab, the vulnerability stems from an integer overflow in the platform's regular expression processing engine. Under certain conditions, an unauthenticated attacker could exploit the flaw to execute arbitrary code on a vulnerable server without needing to log in. While there is currently no evidence that the vulnerability has been exploited in the wild, security experts warn that its severity and broad impact make rapid remediation essential.

GitLab has issued patches across multiple supported and legacy versions, an unusual step that reflects the seriousness of the issue. The company has also released detection rules to help administrators identify potential exploitation attempts.

Only self-managed GitLab environments are affected, while GitLab.com and updated GitLab Dedicated instances already contain the fix. Organisations running self-hosted deployments are strongly advised to apply the latest updates immediately, as GitLab has not provided any alternative workaround. The vulnerability is the latest in a series of high-severity flaws affecting GitLab's regular expression engine and serves as another reminder of the importance of timely patch management for internet-facing development platforms.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.