PHP patches arrived late. Hackers were already inside.
The surface story is a patch rush: PHP vulnerabilities disclosed, governments and companies scrambling. The real story is the sequence. Wired reported that hackers were actively exploiting the flaws before patches existed, and the BBC's Zoe Kleinman put a number on the government exposure — an AI minister citing 500 new vulnerabilities found in government systems. Reuters counted millions of hacking attempts. The gap nobody filled: how long between first exploitation and first patch, and who got hit in that window.
PHP security flaws trigger cyber alarm with '500 new vulnerabilities' found in government systems
5 sources · hover a dot to see coverage
What happened
Security researchers disclosed critical vulnerabilities in PHP, the server-side scripting language that underpins a substantial share of the world's websites and government infrastructure. Following disclosure, Reuters reported millions of hacking attempts as organizations rushed to apply patches. The UK's AI minister publicly stated that 500 new vulnerabilities had been identified in government systems. BBC technology correspondent Zoe Kleinman framed the situation as a cyber event that had not yet fully materialized but was already triggering a dramatic global response. Wired reported that exploitation began before patches were available, meaning some organizations were exposed during the window between discovery and fix. Google, OpenAI, and Amazon were named by CNBC as among the major technology companies responding to the threat. Five outlets covered the story from disclosure through the patch race. What separates the coverage is how each handled the timeline between first exploitation and first available fix.
Wired put the pre-patch exploitation on the record; nobody else did
Wired's headline is the most consequential single piece of reporting in this group: hackers exploited the vulnerabilities days before patches were available. That is not a patch-rush story. That is a confirmed-breach-window story. None of the other four outlets named this timeline explicitly. Reuters reported millions of hacking attempts but did not specify whether those attempts preceded or followed patch availability. The distinction matters because 'rush to patch' implies organizations had a choice; 'already exploited before the patch existed' means some did not.
BBC carried the government exposure number; the rest cited no figure
The BBC's video report quoted the UK AI minister directly: 500 new vulnerabilities found in government systems. That is the only specific count attached to government exposure across all five sources. Reuters, CNBC, and Seeking Alpha covered the story without a government-specific number. Kleinman's separate analysis piece framed PHP as 'the cyber equivalent of an unexploded bomb' and noted the cyber event 'hasn't happened yet' — a framing that sits in tension with Wired's reporting that exploitation had already begun.
CNBC named the tech giants; the security outlets named the attackers
CNBC led with Google, OpenAI, and Amazon responding to the threat. That framing positions the story as a corporate crisis-management event. Wired and Reuters positioned it as an active attack story. The difference is not trivial: naming the defenders without naming the exploitation timeline makes the response look orderly. It was not orderly if hackers were inside before the patches shipped.
What one side told you that the other didn't
Wired confirmed pre-patch exploitation. Four outlets did not.
Wired's reporting establishes that the vulnerability window was not theoretical: attackers were inside before a fix existed. Reuters, BBC, CNBC, and Seeking Alpha all covered the patch rush without specifying that the rush came after exploitation had already started. The consequence is a coverage majority that makes this look like a close call. Wired's reporting suggests it was not a close call for whoever got hit in that window.
500 vulnerabilities in government systems. One outlet has the number.
The BBC is the only source carrying the AI minister's figure of 500 new vulnerabilities found in government systems. That number, if accurate, is the most specific public accounting of government exposure in this entire story. Reuters reported millions of hacking attempts globally but attached no government-specific count. Four outlets covered government exposure in general terms. One outlet has the number. The others have the vibe.
Nobody reported which governments or agencies were actually breached.
Across five outlets, the coverage names the threat, the patch race, the tech-company response, and a vulnerability count. No outlet named a specific government agency confirmed as compromised, a specific attacker group, or a confirmed victim of the pre-patch exploitation window Wired identified. The story is being covered as a warning. Whether it is also an incident report remains unanswered in every source here.
What to watch
If a government agency or major company confirms a breach tied to the pre-patch exploitation window Wired identified, the story reframes entirely from 'patch rush' to 'confirmed incident.' Watch for that confirmation in the next 72 hours. Right-leaning financial outlets that have so far treated this as a market-relevant tech story will likely shift to accountability framing if a named government entity confirms damage.
See how outlets across the political spectrum framed this differently — and what each side left out.