DEV Community: Deepak

Millions of Hacking Attempts Target Websites Worldwide After Critical PHP Security Flaws

Deepak — Thu, 22 Oct 2026 11:12:33 +0000

A major cybersecurity warning has put website owners and developers around the world on high alert. On October 22, 2026, reports described millions of attempts to exploit newly disclosed critical vulnerabilities in PHP, a programming language widely used to build websites and web applications.

According to reports, Cloudflare observed exploitation attempts increase dramatically after the vulnerabilities became public. Several government organizations and businesses temporarily took websites offline while they assessed their exposure and applied security updates.

This incident highlights an important lesson: a vulnerability in widely used software can put many different websites at risk simultaneously.

What Happened?

PHP is a server-side programming language used by websites to process requests, communicate with databases and generate dynamic pages. It is also an important part of popular platforms such as WordPress, Drupal and Joomla.

Security researchers identified two critical PHP vulnerabilities associated with the name php2shell. Depending on the affected software and configuration, these flaws could allow attackers to execute commands remotely on vulnerable servers.

Successful exploitation could potentially allow an attacker to:

Access sensitive files or information.
Compromise server resources.
Interfere with website operations.
Attempt to access databases or credentials.
Gain greater control over a vulnerable system.

The potential impact is significant because PHP is used across a large part of the web.

Sources: Reuters | Associated Press

Why Are Millions of Hacking Attempts Happening?

According to Cloudflare CEO Matthew Prince, the company observed thousands of exploitation attempts in the hours before public disclosure. The number increased to tens of thousands shortly after disclosure, then hundreds of thousands, and eventually millions.

Why does this happen?

When a serious vulnerability becomes public, attackers can quickly search for systems that may be affected. Automated tools can scan large numbers of internet-facing servers much faster than a person could investigate them manually.

AI may accelerate parts of this process, including vulnerability research and the development of attack techniques. However, not every detected attempt succeeds, and a large number of attempts does not automatically mean that the same number of websites has been compromised.

How Does This Affect WordPress and Other Websites?

PHP vulnerabilities can affect the software underneath a website, not just its custom application code.

For example, a business might have a carefully developed WordPress website with secure passwords and a well-designed theme. If the underlying PHP runtime is vulnerable, the website could still be exposed.

Potentially affected environments include:

WordPress websites and plugins that depend on PHP.
E-commerce platforms and online stores.
Custom PHP applications.
Business portals and customer management systems.
Websites running outdated or unsupported server software.

The actual risk depends on the PHP version, deployment configuration and available security fixes. Website owners should verify their own environment rather than assume every PHP website is equally vulnerable.

What Should Website Owners Do Now?

1. Check the PHP version

Find out which PHP version your hosting environment uses. For WordPress, you can generally check under Tools → Site Health → Info → Server, although the exact menu may vary.

You can also check through a trusted hosting control panel or server administrator.

2. Apply official security updates

Review the latest security advisories from the official PHP website. Install the appropriate fixed release for your environment, following your hosting provider's guidance.

Do not assume that updating WordPress alone automatically updates the PHP runtime.

3. Update website dependencies

Update WordPress, themes, plugins and other PHP applications to supported, patched versions. Back up the website and database first, and test important functionality after updating.

4. Review server logs

Check web server, application and security logs for unusual requests, unexpected errors, unfamiliar processes or suspicious file changes.

If you suspect a compromise, preserve logs and involve a qualified security professional. Updating the software alone may not remove an attacker's existing access.

5. Strengthen access security

Use unique, strong passwords, multi-factor authentication where available, restricted administrator access and the principle of least privilege.

Keep backups protected and test that you can restore them.

6. Use temporary protections when necessary

A web application firewall may help block some malicious requests, but it should not be treated as a replacement for patching.

If a vulnerable system cannot be secured promptly, follow official cybersecurity guidance and consider temporarily taking it offline until adequate protection is in place.

The Growing Role of AI in Cybersecurity

One notable aspect of this incident is the role of AI-assisted security research in identifying serious software weaknesses.

AI can help researchers inspect large codebases, identify suspicious patterns and investigate potential vulnerabilities. These capabilities may help defenders find problems earlier.

However, similar capabilities could also help attackers analyze vulnerabilities and develop exploitation techniques more quickly.

This creates a challenge for software maintainers: the time available to investigate, fix and deploy patches may become increasingly short.

The best response is not to avoid AI entirely, but to combine responsible security research with careful testing, coordinated disclosure and rapid deployment of verified fixes.

Key Lessons for Developers

This incident offers several important lessons for anyone building or maintaining web applications:

Keep runtimes updated: Secure application code cannot compensate for every vulnerability in its underlying software.
Monitor security advisories: Follow official notices for PHP and the frameworks and libraries your applications use.
Prepare for emergency updates: Maintain backups, staging environments and a tested patching process.
Reduce unnecessary exposure: Disable unused services and restrict access to sensitive systems.
Verify, don't assume: Confirm the installed version, the applied fix and the system's security status.
Plan for incident response: Know how to isolate affected systems, preserve evidence and recover safely.

Conclusion

The reported surge in PHP exploitation attempts demonstrates how quickly a newly disclosed software vulnerability can become a global security concern.

For developers, hosting providers and business owners, the priority is clear: identify affected systems, apply verified security updates, monitor for suspicious activity and prepare for incidents before they happen.

Cybersecurity is not a one-time task. It requires continuous maintenance, timely updates and a clear understanding of the software running behind every website.

Discussion: How does your team manage emergency security updates? Do you patch immediately, test in staging first, or rely on your hosting provider?

Share your experience in the comments.

# APIs Explained for Beginners: How Applications Communicate With Each Other

Deepak — Thu, 22 Oct 2026 10:08:36 +0000

Learn what an API is, how requests and responses work, and how to use a simple API with JavaScript.

Introduction

Have you ever logged into a website using Google, checked the weather in an app, or paid online?

Have you wondered how different applications communicate with each other?

For example, when you open a weather app, it displays information such as temperature, humidity, and wind speed. But does the app collect all this weather information itself?

Usually, no. It requests the information from another service.

This communication often happens through an API.

APIs are used in web development, mobile applications, payment systems, AI applications, and many other types of software.

In this beginner-friendly guide, we'll understand what an API is, how it works, and how to make a simple API request using JavaScript.

1. What Is an API?

API stands for Application Programming Interface.

In simple terms, an API is an interface that allows one software application to interact with another software system through defined rules.

Imagine you're in a restaurant.

You are the customer who wants to order food.
The kitchen prepares the food.
The waiter takes your order to the kitchen and brings back the result.

You don't need to enter the kitchen or understand how every dish is prepared. You communicate through the waiter.

An API works in a similar way.

Client: The application requesting information.
API: The interface through which the request is made.
Server: The system that processes the request.
Response: The information or result returned to the client.

For example, a frontend application can request a list of products from a backend API without directly accessing the backend's database.

2. Why Do Applications Need APIs?

Imagine you're building an online shopping application.

Your application needs to:

Display products.
Register users.
Process payments.
Track orders.
Send notifications.

You could build all these capabilities yourself, but many services already provide APIs for specific tasks.

For example:

A payment provider can expose an API for processing payments.
A mapping service can expose an API for location and directions.
A weather service can expose an API for weather information.
Your own backend can expose APIs for users, products, and orders.

APIs make it possible for software systems to communicate without needing to know every internal implementation detail of each other.

3. How Does an API Work?

Let's understand the basic flow.

flowchart TD
    A["User"] --> B["Frontend Application"]
    B --> C["API Request"]
    C --> D["Backend Server"]
    D --> E["Process Request"]
    E --> F["Database, if needed"]
    F --> E
    E --> G["API Response"]
    G --> B
    B --> H["Display Result"]

Here's what happens:

Step 1: The user performs an action.

For example, the user opens a product page.

Step 2: The frontend sends a request.

The browser sends an HTTP request to an API endpoint.

Step 3: The backend processes the request.

The server checks the request, applies business rules, and may retrieve information from a database.

Step 4: The server returns a response.

The response may contain product information, an error message, or another result.

Step 5: The frontend uses the response.

The application displays the products or informs the user if something went wrong.

One important detail: not every API request needs a database query. Some APIs calculate results, call other services, or return information directly.

4. What Is an API Endpoint?

An API endpoint is a particular URL through which an API exposes a resource or operation.

For example:

GET /api/products
GET /api/products/101
POST /api/products

These examples describe different operations:

GET /api/products — retrieve a list of products.
GET /api/products/101 — retrieve a particular product.
POST /api/products — request the creation of a product.

These are illustrative routes. The exact behavior depends on how the API is designed.

A complete API URL might look like this:

https://api.example.com/products

Here:

https is the protocol.
api.example.com is the host.
/products is the endpoint path.

The HTTP method helps specify what operation the client wants to perform.

5. What Are HTTP Methods?

HTTP methods describe the intended action for a request.

Method	Common purpose	Example
`GET`	Retrieve information	Get a product list
`POST`	Submit data or create a resource	Create an order
`PUT`	Replace a resource	Replace a product record
`PATCH`	Partially update a resource	Change a product price
`DELETE`	Delete a resource	Delete a product

The actual behavior depends on the API's design.

For example, when a user submits a registration form, the frontend might send a POST request containing the user's details to a registration endpoint.

6. What Is JSON in an API?

JSON stands for JavaScript Object Notation.

It is a common data format used to exchange information between applications.

For example, an API might return this product:

{
  "id": 101,
  "name": "Wireless Mouse",
  "price": 799,
  "inStock": true
}

This response contains:

id: a product identifier.
name: the product name.
price: the price.
inStock: whether the product is available.

The frontend can read this JSON and display the product information.

JSON is widely used because it is lightweight, readable, and supported by many programming languages.

7. Let's Make Our First API Request

Now let's use JavaScript to call a public test API.

We'll use JSONPlaceholder, a service designed for testing and learning.

Example endpoint:

https://jsonplaceholder.typicode.com/posts/1

Open the URL in your browser to see a sample JSON response.

Example using JavaScript

async function getPost() {
  try {
    const response = await fetch(
      "https://jsonplaceholder.typicode.com/posts/1"
    );

    if (!response.ok) {
      throw new Error(`HTTP error: ${response.status}`);
    }

    const data = await response.json();

    console.log("Post title:", data.title);
    console.log("Post body:", data.body);
  } catch (error) {
    console.error("Failed to fetch post:", error.message);
  }
}

getPost();

What does this code do?

1. fetch()

Sends an HTTP request to the API endpoint.

2. await response

Waits for the HTTP response before continuing.

3. response.ok

Checks whether the HTTP status indicates success, generally a status in the 200–299 range.

4. response.json()

Reads and parses the response body as JSON.

5. console.log()

Prints the retrieved data in the console.

6. try...catch

Handles errors that may occur during the request or response processing.

When the request succeeds, you'll see the post's title and body in the console.

This example uses a public testing service. Real APIs may require authentication, have rate limits, or enforce other access restrictions.

8. What Are API Status Codes?

An API response usually includes an HTTP status code that indicates the outcome of the request.

Here are some common examples:

Status code	Meaning
`200 OK`	The request succeeded
`201 Created`	A resource was created successfully
`400 Bad Request`	The request contains invalid data or syntax
`401 Unauthorized`	Valid authentication credentials are missing or invalid
`403 Forbidden`	The client is not allowed to perform the operation
`404 Not Found`	The requested resource was not found
`500 Internal Server Error`	The server encountered an unexpected problem

Understanding status codes makes debugging API issues much easier.

For example, a 404 response may mean that the endpoint URL is incorrect or the requested resource doesn't exist.

A 401 response may mean that the request needs valid authentication credentials.

Always check the API's documentation because the exact error details and behavior vary between services.

9. What Is the Difference Between a Frontend, Backend, and API?

These terms are related, but they are not the same.

Frontend

The part of an application that users interact with, such as buttons, forms, and product pages.

Common technologies include HTML, CSS, JavaScript, and React.

Backend

The server-side application that handles business logic, validation, permissions, and data processing.

Common technologies include Python, Node.js, Java, and other server-side

AI Sandboxes Explained: How AI Agents Run Code Safely

Deepak — Wed, 21 Oct 2026 10:12:32 +0000

Understanding isolated environments, Docker, and the security challenges of AI agents.

Imagine asking an AI agent to write code, run commands, test an application, and fix errors automatically.

Sounds useful, right?

But what happens if the AI-generated code deletes an important file, accesses sensitive data, or runs an unsafe command?

This is one of the challenges developers face when building AI agents that can execute code and interact with computer systems.

The solution is not simply to trust every command generated by AI. Developers need to control where that code runs and what it can access.

This is where sandboxing becomes important.

In this article, we'll explore what an AI sandbox is, why AI agents need isolation, how Docker can help, and what developers should consider when running AI-generated code.

1. What Is an AI Sandbox?

A sandbox is an isolated environment where software can run with restricted access to the surrounding system.

Think of it as a separate room in your house. Someone inside the room can perform specific tasks, but they cannot automatically access everything else in your house.

In software development, a sandbox can restrict access to files, processes, network connections, and system resources.

For example, instead of executing AI-generated Python code directly on a developer's main computer, an application could run it inside a properly configured container or another isolated environment.

The goal is to limit the potential impact if the code behaves unexpectedly.

In simple terms: An AI sandbox gives an AI agent a controlled environment in which to perform tasks.

2. Why Do AI Agents Need Sandboxes?

Traditional chatbots primarily generate responses. AI agents can go further when connected to tools that allow them to execute code, access files, or perform actions.

These capabilities are useful, but they introduce additional risks.

Accidental damage

An AI-generated script might overwrite a file, delete data, or modify the wrong directory.

Unintended access

If an agent has access to sensitive files, environment variables, credentials, or internal services, generated code might expose information it should not access.

Unsafe commands

A command may behave differently from what the developer or AI expects. It might consume excessive resources, modify system settings, or perform an unintended operation.

Untrusted code

AI-generated code can contain bugs or unsafe operations even when the original request is harmless.

A sandbox helps reduce these risks by limiting the environment in which code can execute.

However, sandboxing is an additional security layer, not a guarantee that every action will be safe.

3. How Does an AI Sandbox Work?

A simplified workflow looks like this:

A user gives an AI agent a task.
The AI generates code or selects an available tool.
The application checks whether the requested action is permitted.
The code runs inside an isolated environment.
The environment returns its output, logs, or errors.
The AI uses the results to decide what to do next.

For example, a user might ask:

"Write a Python script that reads a CSV file and calculates the total sales."

The agent generates the script and sends it to a controlled execution environment.

The environment runs the script using only the files and resources that have been permitted.

The output is returned to the agent, which can explain the result or help fix an error.

The important point is that the AI generates or requests an action, while the execution environment determines the actual boundaries within which that action runs.

4. What Is Docker, and How Can It Help?

Docker is a platform for packaging and running applications in containers.

A container packages an application with its required dependencies and runs it using operating-system-level isolation.

Containers are useful for development, testing, and running automated tasks in controlled environments.

For AI agents, a container can provide a separate execution environment instead of allowing generated code to run directly on the host system.

For example, a developer might configure a container with:

A specific Python version.
Only the required project files.
Limited CPU and memory.
Restricted network access.
No unnecessary credentials.
A non-root user and limited permissions.

These restrictions help reduce the potential impact of unexpected behavior.

However, Docker containers share the host operating-system kernel. A container is not the same as a separate physical computer or a fully isolated virtual machine.

Its security depends on configuration, permissions, the host system, and the workload.

For high-risk or untrusted workloads, stronger isolation technologies may be appropriate.

5. A Simple Docker Example

Suppose you want to run a Python script inside a container.

First, create a file named hello.py:

print("Hello from an isolated environment!")

Next, create a Dockerfile:

FROM python:3.12-slim

WORKDIR /app

COPY hello.py .

CMD ["python", "hello.py"]

Build the image:

docker build -t sandbox-demo .

Run the container:

docker run --rm sandbox-demo

Expected output:

Hello from an isolated environment!

This example demonstrates running a Python script in a container rather than directly through the host's Python interpreter.

Important: This is a basic Docker demonstration, not a production-ready security sandbox for untrusted AI-generated code. It does not configure every necessary security restriction.

A real execution service should consider disabling networking where possible, dropping unnecessary Linux capabilities, enforcing CPU and memory limits, avoiding privileged containers, restricting filesystem access, and using additional isolation when appropriate.

Never mount sensitive host directories or expose credentials to untrusted code unnecessarily.

6. What Is the Difference Between a Sandbox and a Docker Container?

These terms are related, but they do not mean the same thing.

Concept	Meaning
Sandbox	A security approach that restricts what code can do.
Docker container	A way to package and run software in an isolated environment.
Virtual machine	A virtualized computer with its own operating-system environment.
AI agent	A system that can use a model and tools to perform tasks.

A Docker container can be part of a sandboxing strategy, but not every container is securely configured as a sandbox.

Likewise, sandboxing can be implemented using other technologies, including virtual machines and specialized execution environments.

The right choice depends on the threat model, performance requirements, and level of isolation needed.

7. What Should Developers Restrict?

When building an AI agent that executes code, developers should consider several security boundaries.

Filesystem access

Give the agent access only to the files required for its task. Avoid exposing private keys, passwords, and unrelated application data.

Network access

If the task does not require internet access, consider disabling network access. Otherwise, allow only the destinations that are necessary.

System permissions

Avoid running untrusted code with administrator or root privileges. Use the minimum permissions required.

Resource limits

Set limits for CPU, memory, execution time, disk usage, and the number of processes where supported.

Secrets and credentials

Do not automatically pass production credentials or sensitive environment variables into an execution environment.

Cleanup

Remove temporary files and terminate execution environments when tasks finish or exceed their allowed time.

Monitoring

Record relevant execution logs and errors while avoiding unnecessary collection of sensitive data.

Security should be designed into the execution environment rather than added only after a problem occurs.

8. Does a Sandbox Make an AI Agent Completely Safe?

No.

A sandbox can reduce risk, but it cannot eliminate every security problem.

For example:

A misconfigured container may expose sensitive host resources.
An application might accidentally pass secrets to the agent.
A tool may have more permissions than the task requires.
A vulnerable isolation mechanism may be exploited.
A network-enabled environment might communicate with an unintended destination.

Developers should also validate tool inputs, enforce authorization checks outside the AI model, apply least-privilege permissions, and monitor execution.

For especially sensitive workloads, consider stronger isolation, short-lived environments, and independent security reviews.

The key principle is simple: Never rely on the AI model alone to enforce security boundaries.

9. Where Are AI Sandboxes Useful?

Sandboxed execution can be useful in many applications.

AI coding assistants: Run generated code, execute tests, and inspect errors.

Automated testing: Let an agent experiment with test scripts in a controlled environment.

Data analysis: Execute analysis code against explicitly permitted datasets.

Educational tools: Allow learners to run code without giving the execution environment unrestricted access to the host.

AI development platforms: Provide temporary environments where agents can install approved dependencies and complete programming tasks.

Each use case has different requirements. A simple coding exercise may need only a restricted container, while an environment executing arbitrary untrusted code may need a much stronger security design.

10. What Happens When AI Gets Its Own Computer?

Giving an AI agent access to an execution environment changes what it can do.

It can move beyond generating suggestions and start running code, testing ideas, observing results, and making further decisions.

But more capability also means more responsibility for the developers building these systems.

The important question is not only whether an AI agent can complete a task. It is also whether the application can limit the damage if the agent makes a mistake.

That is why execution environments, permission controls, monitoring, and isolation matter.

A well-designed system gives an agent the resources it needs for a task without automatically granting access to everything else.

Conclusion

AI agents are becoming more capable of writing and executing code, but their generated actions should not automatically be trusted.

Sandboxing helps developers create controlled environments where code can run with restricted access to files, system resources, and external services.

Docker can be one useful building block, but a container alone does not guarantee complete isolation. Secure implementations require careful configuration and additional controls appropriate to the threat model.

As AI agents become more capable, safe execution environments will remain an important part of building reliable AI applications.

The goal is not to prevent AI from doing useful work. It is to let AI work within clear and carefully enforced boundaries.

Question for Developers

If you were building an AI coding agent, would you use Docker containers, virtual machines, or another sandboxing approach to execute untrusted code? What security controls would you prioritize first?

I'd love to hear your thoughts in the comments.

DEV Community: Deepak

Millions of Hacking Attempts Target Websites Worldwide After Critical PHP Security Flaws

What Happened?

Why Are Millions of Hacking Attempts Happening?

How Does This Affect WordPress and Other Websites?

What Should Website Owners Do Now?

1. Check the PHP version

2. Apply official security updates

3. Update website dependencies

4. Review server logs

5. Strengthen access security

6. Use temporary protections when necessary

The Growing Role of AI in Cybersecurity

Key Lessons for Developers

Conclusion

Further Reading

# APIs Explained for Beginners: How Applications Communicate With Each Other

Introduction

1. What Is an API?

2. Why Do Applications Need APIs?

3. How Does an API Work?

4. What Is an API Endpoint?

5. What Are HTTP Methods?

6. What Is JSON in an API?

7. Let's Make Our First API Request

Example using JavaScript

What does this code do?

8. What Are API Status Codes?

9. What Is the Difference Between a Frontend, Backend, and API?

AI Sandboxes Explained: How AI Agents Run Code Safely

1. What Is an AI Sandbox?

2. Why Do AI Agents Need Sandboxes?

Accidental damage

Unintended access

Unsafe commands

Untrusted code

3. How Does an AI Sandbox Work?

4. What Is Docker, and How Can It Help?

5. A Simple Docker Example

6. What Is the Difference Between a Sandbox and a Docker Container?

7. What Should Developers Restrict?

Filesystem access

Network access

System permissions

Resource limits

Secrets and credentials

Cleanup

Monitoring

8. Does a Sandbox Make an AI Agent Completely Safe?

9. Where Are AI Sandboxes Useful?

10. What Happens When AI Gets Its Own Computer?

Conclusion

Question for Developers

Further Reading