Analyzing the News: The PHP security scramble

Thirteen outlets covered the PHP flaws that knocked websites offline this week. Fíor read four of them as AI.

Fíor is a natural language classifier that predicts whether a piece of text was more likely written by a person or by AI.

On 21 October, the developers of PHP rushed out fixes for two critical flaws in the programming language, which runs an estimated 70% of websites. Both let an attacker run code on a web server without logging in. Details had leaked online the day before, ahead of the planned disclosure, so the fixes came out early. The flaws were found with the help of AI tools, by the security firm Calif working through an OpenAI programme, and separately by Wiz, which Google owns.

Governments told organisations to patch at once. Britain's National Cyber Security Centre said to consider taking offline anything that could not be fixed straight away. Government websites in several countries went down as a precaution, and attempts to exploit the flaws followed.

The outlets were Reuters, AP, the BBC, the Guardian, WIRED, The Verge, TechCrunch, CBS News, ABC News in the US, ABC News in Australia, Al Jazeera, Euronews and TechTarget. That is two wire services, American, British and Australian broadcasters and newspapers, technology and security outlets, and Al Jazeera and Euronews. Some of these articles carry agency material alongside their own reporting.

The result

Nine read as human: Reuters, AP, the Guardian, The Verge, TechCrunch, ABC News in the US, ABC News in Australia, Al Jazeera and TechTarget.

Four read as AI: the BBC, WIRED, CBS News and Euronews.

None was a close call. For the BBC and Euronews, both of Brath's labels said AI. For WIRED and CBS News, it judged the article likely written by AI but was unsure how it reads. None of the thirteen drew a writing-habit flag.

This is the fourth story scanned with Brath, Fíor's new model. It first called coverage AI in the Tesla and SpaceX piece. Four of thirteen is its highest count so far.

Some outlets keep landing the same way. Euronews has read as AI in four of its five appearances in the series. Others move. The Guardian has read as AI in five of the seven stories where it ran its own reporting, and read as human here.

The ones that read as AI

Two of the four were explainers. The BBC asked what PHP is and why it caused a global scramble. CBS News told readers what they needed to know. In the last story, TIME's explainer read as AI too.

Explainers are the obvious pattern. They do not settle it. The Verge explained the same problem for a general reader, under the headline "PHP: The three letters that shut down sites all over the internet today", and it read clearly as human.

Why security coverage reads like this

A story like this moves fast, and it comes wrapped in official language. Advisory numbers, severity scores, and the same instruction from every agency: patch now. Much of the coverage reworks the same warnings.

The pieces that went beyond them all read as human. TechTarget reconstructed how the disclosure fell apart, with an interview from inside the industry. The Guardian tracked the millions of attempts to exploit the flaw. ABC News in Australia followed what happened to the country's own government sites.

Some of these pieces may have had AI help, with a first draft, a rewrite of wire copy or a final polish. Or explainers have become formulaic enough that a reporter and a model would write them the same way. Fíor cannot tell those apart on its own.

AI helped find flaws that had sat in PHP for years, and the system for disclosing them quietly, built for a slower pace, did not last the week. The articles explaining what that means were the ones most likely to read as AI.

What Fíor is

Fíor is a machine learning classifier, currently in beta and available as a browser extension. It gives a prediction, not a verdict. It cannot see who sat at the keyboard, and nothing here is a claim about any journalist or publication. Reading as AI and being written by AI are not the same thing.

Treat it as a signal, not proof, and check the pages you read yourself.

Try the browser extension at Fíor.

Analyzing the News is a series where we run one major story through Fíor and see what comes back.