Zing Open Zing
Technology

Global cybersecurity crisis unfolds with PHP vulnerabilities and Chinese-linked breaches

22 October 2026 · Source balance: Slightly Left of Centre

The internet experienced a severe cybersecurity crisis on October 21 and 22, 2026, when multiple catastrophic incidents struck simultaneously. First, critical vulnerabilities in PHP—which powers about 70 percent of websites worldwide—were publicly disclosed after leaking ahead of schedule. These flaws, rated severity 9.2 out of 10, allow hackers to remotely execute malicious code without authentication. Governments worldwide, from the NSA to European cybersecurity agencies, urged organizations to immediately patch or take systems offline. Second, Chinese state-aligned hackers breached ConnectWise, an IT management platform used by thousands of organizations, and used AI-powered tools to attempt break-ins at nearly 3,000 attempted logins per minute, compromising around 2,250 organizations across government, defense, aerospace and finance sectors. The incidents exposed broader systemic vulnerabilities in how the internet infrastructure is secured and highlight how artificial intelligence is accelerating both vulnerability discovery and exploitation. While patches became available on October 21, the full scope of compromise remains under investigation across hundreds of organizations.

Key facts

  • Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) rated 9.2 severity were discovered by Calif, OpenAI, and Wiz using AI detection
  • PHP powers approximately 70 percent of all websites globally, including WordPress and Drupal platforms
  • Chinese state-aligned hackers attributed by Microsoft to Storm-0940 breached ConnectWise cloud backup service and compromised approximately 2,250 organizations
  • Attackers used ARTEX, an AI-powered penetration testing framework, to attempt nearly 3,000 login attempts per minute across target organizations
  • Government websites in multiple countries including Finland and the Netherlands went offline as precaution while awaiting patches
  • NSA, CISA, and cybersecurity agencies in UK, Canada, Australia, and EU urged immediate patching or system shutdown
  • Patches were released October 21, 2026 for PHP versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12

How different outlets framed it

Left-leaning coverage: Left-leaning outlets emphasize the need for stronger government regulation of software security and corporate accountability. They highlight how the crisis demonstrates market failures in cybersecurity and call for stricter standards on software developers to ensure security by design, along with increased government investment in critical infrastructure defense and scrutiny of vendor relationships.

Right-leaning coverage: Right-leaning commentary emphasizes the threat posed by Chinese state-backed hackers as a national security concern and questions soft approaches to China in cybersecurity policy. They highlight the value of market-driven solutions and rapid private sector response, while noting concerns about government mandates that could stifle innovation or burden small businesses with compliance costs.

Limits of this briefing

The full scope of the ConnectWise breach and PHP2Shell exploitation remains unknown as investigations are ongoing. Attribution of Chinese involvement in ConnectWise relies on Microsoft's assessment, which China disputed. Early exploitation activity was detected before patches released, making exact compromise numbers difficult to verify.

Sources

More stories

See all latest stories