Critical PHP vulnerabilities expose 70% of web; patching underway globally

Two critical remote-code-execution vulnerabilities in PHP affect approximately 70% of websites globally. Within hours of October 23, 2026 disclosure, millions of exploitation attempts were detected across global networks; no confirmed successful breaches were reported as of late October 23. Immediate consequences: Wikipedia, government portals (Finland, Netherlands, Scotland, UK), Japanese banks (Mitsubishi UFJ, Nomura), railways (East Japan Railway, ANA), SoftBank's emergency alert system, and numerous retailers temporarily went offline for emergency patching. Organizations without patches remain at risk; security researchers warn that thousands of systems worldwide remain unpatched, especially small organizations and sites with limited security resources. The incident has raised concerns about the vulnerability of aging open-source infrastructure and the dual-use implications of AI-assisted vulnerability discovery.