Chrome is adding a milder warning for risky sites, while two serious PHP flaws put millions of websites at risk. Site owners should check their updates.
Chrome is getting a new pop-up that says "This site doesn't seem right" when a page looks risky but is not clearly dangerous. The bigger story for anyone with a website is two serious flaws in PHP, a language behind about 70% of sites. Spotify and the Arc browser also made changes.
Chrome already blocks sites it is confident are dangerous. It shows a full-page red warning. The new alert is for sites that fall in between. They show patterns similar to malicious sites, but Chrome is less sure. The page still loads, and a pop-up offers two buttons: Back to safety, which is highlighted, and mark as safe.
The warning works on Chrome for mobile and desktop, but only when Enhanced Protection is turned on. It is similar to a downloads warning Chrome added in 2024, which separates suspicious files from dangerous ones. The material does not say when every user will see it.
The flaws are named PHP2Shell and carry the labels CVE-2026-109618 and CVE-2026-109619. They are memory-related problems that could let a hacker run harmful code on a site from far away. They affect PHP 5.4 and later, including versions as old as 20 years.
PHP is used by platforms such as Wikipedia and WordPress. Patches are out. Even so, millions of attacks have targeted websites, and several sites were taken offline to protect themselves while IT teams rushed to install fixes.
If you only browse the web and do not run a site, there is no PHP update for you to install. The fix sits with site owners and their hosting providers. Your part is small: Enhanced Protection in Chrome adds a layer of warning. Spotify users outside a Family plan can ignore that change.
The alert box above lists the steps. The most urgent ones are for anyone with a website: confirm the PHP version has the latest security update, and keep WordPress and its plugins current. A web host or IT person can answer this quickly.
Expect more sites to patch as owners catch up. The material does not say how many sites remain exposed, or whether the Chrome warning will reach everyone soon. Arc's accounts are deactivated on December 22, and the company says personal data will be deleted within 30 days.
If you run a website, confirm its PHP and WordPress updates now, and turn on Enhanced Protection in Chrome for the new warning.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youCode in an iOS 27.3 beta suggests Apple's HomeView smart display could run AI chatbots such as ChatGPT next to Siri. Nothing is confirmed.
Read more: Apple's smart home screen may soon let you talk to ChatGPTA How-To Geek writer has Claude read his Todoist list each weekday morning and brief him, with read-only access and no changes unless he says yes.
Read more: He set up Claude to read his to-do list and brief him every morning
