The PHP Foundation disclosed two critical vulnerabilities Wednesday in the code that quietly powers a huge share of the web, then shipped an emergency patch. Together they’re called “php2shell”, filed as CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution. No login, no credentials, no barrier.

Yeah, I didn’t fully understand it either. In plain terms: an attacker can run code on a vulnerable server, change what’s on the page and reach databases, passwords, API keys and certificates. The NSA, FBI, the U.K.’s NCSC and CERT-EU all told organizations to patch immediately or take systems offline. Cloudflare’s chief technology officer reported early attacks already underway.

As WIRED pointed out, “this is not a drill.” The flaws were spotted in August by the red-teaming firm Calif using OpenAI's GPT-5.6 Sol model, separately by OpenAI internally and independently by Google-owned Wiz. According to Fortune, the bug had been sitting in PHP for more than a decade, The Verge says closer to 20. A limited version of it surfaced in 2024 and was waved off as too hard to exploit.

Wiz estimates roughly 70% of the internet is affected, reports BBC News. Palo Alto Networks counted 22.6 million potentially vulnerable instances. Government agencies in Finland and the Netherlands went dark, as did Edinburgh council, parts of Wikipedia, DeviantArt and some BBC programme pages.

Which versions are actually exposed is still unresolved; CERT-EU said it could be every release going back to PHP 5 in 2004. Confirmed breaches remain thin and Mother Jones is tracking the broader AI-attack question. If your site runs on Squarespace or Wix, you’re fine. Everyone else is in a patching race against the same technology that found the hole.

Stephen Hubbard is out. Russia released the 74-year-old retired Michigan teacher on Wednesday, the same day Vladimir Putin sat down with Trump envoy Steve Witkoff at St. Petersburg's Constantine Palace for roughly three hours of Ukraine talks. Hubbard, a National Guard and Air Force veteran, was captured in Ukraine shortly after the February 2022 invasion and sentenced in 2024 to nearly seven years on charges of fighting as a mercenary.

He was the last American in Russia formally designated wrongfully detained, though as many as 10 other Americans remain in custody there, The Guardian reported. CBS News said he was expected to be flown to a military hospital in Texas. His arrival and condition haven't been confirmed. President Donald Trump said the release required no prisoner swap. Then he tied it to his decision five days earlier to waive sanctions Congress had passed against Russia—a move lawmakers in both parties criticized.

Despite Witkoff calling him “a humanitarian,” Putin is wanted by the International Criminal Court. The Kremlin agreed “in principle” to three-way talks with Washington and Kyiv after Nov. 10, while dismissing the Oslo proposals as containing “little of real value.”

A New Mexico state judge ordered Meta to pay $25 billion in penalties over the Cambridge Analytica data privacy scandal, landing the hit hours before the company reported third-quarter earnings Wednesday. A jury last month found Meta liable for deceiving users about Facebook’s data privacy and content moderation policies. The company plans to appeal, naturally.

Then came the numbers, and they were a split screen. Revenue climbed 26% to $64.6 billion, beating estimates, Variety reports. Operating income went the other way, falling 37% to roughly $13 billion. The culprit? A $9.89 billion charge tied to an August settlement with 52 state attorneys general over teen mental health harms, a deal that calls for payments of up to about $18.59 billion. Chief financial officer Susan Li warned that more youth-related trials are scheduled in the U.S. in the coming months, too.

But investors shrugged. Shares rose 4% to 5% after hours as Wall Street fixed on Meta’s AI spending, including its Muse agent and a new nonvoting Class C share class launching in January 2027 to help bankroll it. A $25 billion judgment, apparently, is a rounding error for this company.