Andrew Chang explains why fixing a PHP flaw isn't enough
CBC News' About That traces an AI-discovered vulnerability from a software flaw to an urgent patch rollout, with a warning about intruders already inside.
CBC News
Story of Why this story? The video opened at a pace of 603,608 views a day, 17 times a normal first day on this channel (34,886).
PHP flaw: How AI just hacked an unhackable part of the internet | About That
Things we can learn from the video
Press to jump
- 1:25PHP runs on web servers, processing browser requests and helping generate the pages people see.
- 3:15Chang reports that Wiz used advanced AI models to discover the vulnerability called PHP2Shell.
- 4:10An overwhelmed-waiter analogy explains how memory disclosure bugs can leak confidential information.
- 9:02An accidental disclosure disrupted the coordinated patch timeline, forcing companies to rush their fixes.
- 10:44Patching the flaw does not remove access that attackers may already have established.
Closing a security hole does not evict anyone who has already slipped through it. That is the practical warning at the end of Andrew Chang's new PHP explainer, which has drawn roughly 240,000 views in six hours, an unusually fast start for CBC News.
In "PHP flaw: How AI just hacked an unhackable part of the internet | About That", Chang examines a vulnerability that CBC reports forced governments and major websites offline while they worked to secure their systems. The report says cybersecurity firm Wiz used advanced AI models to uncover the flaw, dubbed PHP2Shell.
PHP might be unfamiliar to someone who uses it indirectly every day. Chang explains how servers use the programming language to process browser requests and generate webpages, with WordPress and Wikipedia among the examples of its reach.
His way into the technical problem is an overwhelmed restaurant waiter: a familiar situation used to explain how memory disclosure bugs can expose information a system should keep private. The stakes extend beyond a malfunctioning webpage to sensitive credentials, user data and potentially control of accounts.
The report then turns to the patch rollout. Security executive Tarah Wheeler says a research firm's accidental video leak exposed the vulnerability before the coordinated fixes were fully ready, forcing a scramble.
Chang's final distinction is between repairing the weakness and clearing out access attackers may already have established. As he puts it: "You can patch the hole, but you still have squirrels."
Published on Trari
Where next?
Is this your channel?For the channel's owners and team: a ready picture, text and badge for your audience
Share the story with your audience. Everything is ready:
For an Instagram story or a WhatsApp status
For a community post or your channel's description
For your website
You may use the picture, the badge, and link it to this story.
- Channel
- CBC News
- Subscribers
- 4,780,000 ▲ 10,000 this week
- Channel views, last 7 days
- 19,129,248
- Channel views, pace per day
- 1,987,092 (on a normal day: 2,681,430)
- Video published
- October 23, 2026
- Video views so far
- 239,527 (less than a day online)
- Video views, pace per day
- 603,608
The numbers
The PHP explainer is drawing views far faster than CBC News' usual regular upload. Its first-day projection is an estimate, not a completed day's total.
💡 Test your knowledge
Who hosts this About That explainer?
Andrew Chang presents the PHP vulnerability explainer for CBC News' About That.