On 20 October 2026, it was reported that two critical vulnerabilities in PHP identified by artificial intelligence (AI) had been leaked ahead of their intended public disclosure.
The ORX News team analysed the story from an operational risk perspective, identifying the potential implications for financial organisations managing cyber-related risks. Our community of members and subscribers can log in to read the full article which examines the causes and impacts of the critical PHP security vulnerabilities, as well as the measures taken by financial firms and other organisations in response.
Get the latest analysis of big operational risk events with ORX News
ORX News provides daily insights, summaries and analysis of operational risk losses from around the globe. Get in touch today to discuss how your firm could benefit from access to ORX News.
ORX News article: Critical PHP vulnerabilities and their impact on financial firms
PHP, an open-source programming language maintained by volunteers, was reportedly used in around 70 per cent of all websites, including sites that used WordPress, Drupal and Joomla. On 1 August 2026, cybersecurity researchers aided by large language models (LLMs) identified certain zero-day vulnerabilities in PHP. The first flaw could be exploited to remotely execute code on websites without being logged in. Another could allow an attacker to read sensitive data – including passwords, tokens and API keys – from a PHP process’s memory without the need to remotely execute code.
trueThe full blog is only available to ORX members and service subscribers
Want to read this blog?
If your firm is a member or subscriber of ORX, log in or create a website account to read this resource.
Not an ORX member or subscriber? Talk to us today to discuss how you could join the ORX community.
