Ongoing

  1. ElectionsHot
  2. US mid-termsHeating up
  3. AICooling
NewsbriefSouth Africa, briefly.
JoburgJHB29°69%
CTCT21°90%
PretoriaPTA33°75%
DurbanDBN30°20°

PHP project patches two critical remote code flaws

Published

The PHP project released fixes on Wednesday for two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4.0 scale. An attacker could use them to run code on a server and potentially take control.

The US cyber agency CISA said it had not seen anyone exploit the flaws as of publication. Researchers also reported very little activity beyond reconnaissance.

CERT-EU said the flaws could affect every PHP version from 5 onward. It advised organisations to prepare to update quickly. Britain's National Cyber Security Centre gave the same advice and also urged organisations to isolate internet-facing applications.

OpenAI said in a blog that the AI firm Calif found the bug using OpenAI's GPT-5.6 Sol. The security firm Wiz found and reported it independently. OpenAI described a two-month effort involving PHP maintainers, researchers and security providers.

Key facts

Who
CERT-EU (said the flaws could affect every PHP version from 5 onward and advised…); National Cyber Security Centre (Britain's agency that advised organisations to prepare to update quickly and…); Calif; Wiz (security firm that independently found and reported the bug)
What
The article describes two critical vulnerabilities in PHP, a web programming language it says is used by the majority of the internet, which it says threatened widespread disruption. Only the headline and description were available, so details of the bugs are not established.
When
24 October 2026
Status
Reported

Related stories

Elections Hot

What you need to know

Voting in the 2026 Local Government Elections is under way at 23,696 stations, and the Electoral Commission of South Africa (IEC) reported a smooth start on 4 November. Stations opened at 7am and close at 9pm, and by 10am preliminary figures showed 3,523,691 voters had cast ballots.

There were problems: unused ballot papers were stolen from Mnyameni Secondary School near Durban, police opened a case, and the IEC relieved the station staff of duty. Some voters in Tshwane said they were turned away for wearing party shirts, but the IEC denied this and said only mayoral candidates' entourages were barred.

ANC chairperson Gwede Mantashe told members not to query the results or discredit the IEC, while the IEC said false online claims show routine procedures as fraud.

  1. BOSA's Solomons flags one-ballot problem at Cape Town voting stations
  2. Mashatile urges new councillors to put voters first
  3. IEC dismisses MK Party worry about dead people on voters' roll

See every update

US mid-terms Heating up

What you need to know

Democrats won back both the US House and Senate in the midterm elections held on 3 November, according to media projections. Exit polls showed voters were angry about high prices and the direction of the country, and rebuked President Donald Trump.

Before the vote, US forces struck targets on Qeshm Island in Iran, while Republicans struggled to defend the war against Iran on the campaign trail. Iranian officials said US voters rejected the war, and Tehran stayed on high alert for possible new US strikes.

Markets reacted, with the dollar hitting a one-month low and the rand firming to around R16.55, as analysts pointed to fears of gridlock in Washington.

  1. Iran welcomes Democratic wins in US midterm elections
  2. Democrats win US Congress in midterm vote, projections show
  3. Ramaphosa wants US trade deal after AGOA suspension

See every update

AI Cooling

What you need to know

Nvidia has told its cloud computing clients to sell at least 51% of their services to non-Chinese companies, according to five people with knowledge of the matter. Anthropic said it has committed to spend close to $900bn on AI infrastructure, and that its computing costs are rising faster than its revenues.

Elsewhere, reports from unnamed sources say OpenAI's latest funding round is falling short of expectations, and a judge let the NAACP pollution case against xAI proceed. In South Africa, the VAST AI investment scheme went offline on 30 October after withdrawals marked approved did not arrive, according to a news investigation.

  1. Accenture faces accusations over AI report with false citations
  2. CrowdStrike to buy two AI security startups
  3. Google lets schools turn off AI tools but limits Search

See every update