EFF warns of 'Vulnerability Apocalypse' in PHP and urges corporate support for open‑source security

What happened

The EFF blog describes a surge of critical PHP vulnerabilities discovered with AI models and actively exploited since mid‑October 2026. Over 33 million websites remain vulnerable, and a premature patch release by Chainguard exposed exploit details. The post calls on corporations to fund and contribute to open‑source projects to prevent future large‑scale security failures.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• The article highlights urgent data‑security risks from unpatched open‑source software and advocates corporate funding to protect user privacy.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Map the security requirements to existing controls and close gaps.
3. Inventory AI or automated decision systems in scope and their assessments.