Feed aggregator

A couple got engaged Saturday at the Twenty One Pilots concert at Ohio Stadium -- their biggest show ever.

The Franklin County Board of Elections said early voting turnout is about two-and-a-half times higher than the last midterm election.

As e-bikes grow in popularity, health leaders are warning of serious injuries among young riders.  

Between 2025 and 2026, Ohio saw its second-highest number of domestic violence-related fatalities after a record high last year.

The Bexley Police Department (BPD) is investigating after stickers with swastikas on them were placed on some campaign signs around the city.

Data centers have generated billions of dollars for Ohio’s economy, but a new analysis found that those benefits are on track to dramatically drop in the next few years.

COLUMBUS, Ohio (WCMH) -- Eight months after a construction worker was killed in a hit-skip crash, the man who allegedly fled the scene has been arrested and charged with aggravated vehicular homicide, court records state. Aaron Swift, 46, was indicted Tuesday on charges of aggravated vehicular homicide, felony hit-skip and tampering with evidence, according to [...]

CHILLICOTHE, Ohio (WCMH) -- President Donald Trump will be coming to central Ohio for a rally less than one week before Election Day. Trump is scheduled to speak in Chillicothe on Oct. 28 at 7 p.m. with a signup form opening up to attend the "Midterm Rally." This is the president's third rally he is [...]

The home where two Licking County adults are being charged with letting nine children live in unsafe conditions was reportedly infested with hundreds of bugs and some children were made to sleep in an adjoining shed.

COLUMBUS, Ohio (WCMH) -- Vice President J.D. Vance told Ohio Republicans to "stop whining" about an advertisement taking spotlight in the state governor's race. Vance, an Ohioan, said on Wednesday that Republicans should focus on winning instead of whether they think Republican gubernatorial candidate Vivek Ramaswamy's ad is appropriate. The ad features Democrat Amy Acton's [...]

CIRCLEVILLE, Ohio (WCMH) -- The Circleville Pumpkin Show kicked off Wednesday morning, with a weigh-in of the local-grown, gargantuan pumpkins that can reach over 1,000 pounds, with one shattering the show's record. The four-day event is a celebration of all things pumpkin, and for pumpkin grower Troy Vanarsdalen, that celebration is well underway, as his [...]

Expect to see quite a few websites serving “404” or “Page Not Found” errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.

Image: Shutterstock.com, Sashkin.

The flaws at issue are present in PHP, the programming language that powers sites running on a large number of web publishing systems, including Drupal, Magento, Joomla and WordPress. Earlier today, PHP released an emergency security update to fix two critical bugs that can allow an attacker to execute code of their choosing on a vulnerable server.

Reuters reports that government websites in Europe and elsewhere went offline today after the PHP vulnerabilities were disclosed. Cloudflare said it has already detected some exploitation of the flaw, and that at 3:02 am (UTC) it implemented web application firewall rules to protect websites from attack traffic seeking to exploit the bugs, which could cause a denial of service condition, remote code execution, and data exposure.

OpenAI, which was involved in the vulnerability research and outreach, said “given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.”

Security experts at Wiz said every PHP version released in the last decade is affected by at least one of these vulnerabilities [full disclosure: Wiz is an advertiser on this blog].

“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” reads a blog post published today by a team of researchers at Wiz, which was one of several organizations credited with discovering the vulnerabilities. “The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

The Wiz researchers say it is likely the PHP vulnerabilities will be mass-exploited to install web-based backdoors or “web shells,” which give attackers a web-based panel that allows them to remotely control infected sites. Wiz said that prior to the PHP bugs being publicly disclosed, the company worked with the PHP team, Calif and OpenAI to measure the size of the problem and coordinate patch verification and disclosure.

The PHP zero-day vulnerabilities are being tracked by their CVE numbers, CVE-2026-109618 and CVE-2026-109619, and they affect all web servers running PHP 5.4 or later. The bugs are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

According to Wiz, PHP is so deeply embedded in many web applications that we are likely to see organizations struggling to patch these vulnerabilities for some time to come, comparing this PHP vulnerability pair with the Log4Shell weakness that emerged in 2021 — a widespread, severe-as-it-gets security flaw in Log4j, a popular Java logging framework.

“A vulnerability in core PHP reaches far beyond a single application,” the Wiz researchers wrote. “PHP runs across clouds, hosting providers, content-delivery networks and millions of independently managed servers. Reducing exposure before the technical details became public required coordinated work across that entire ecosystem.”

The SANS Internet Storm Center is keeping an eye on major software platforms that are shipping updates to deal with these PHP flaws. For example, Ubuntu just released updated PHP packages.

This is a fast-moving story. Updates will be noted here with timestamps.

COLUMBUS, Ohio (WCMH) -- A Whitehall man who pleaded guilty in a fatal shooting at a northeast Columbus bar and grill will spend up to 19.5 years in prison, according to court records. Armando Flores, 29, was arrested and charged with voluntary manslaughter, murder, illegal possession of a firearm and having a weapon under disability [...]

A retail brand specializing in children’s home furnishings and bedding will soon return to Easton Town Center.

The Columbus Crew are set to host St. Louis City SC at 8 p.m. Wednesday for the U.S. Open Cup title to conclude the 111th edition of one of the longest running sporting events in America.

A historic four-bedroom American Foursquare-style home overlooking Schiller Park in Columbus's German Village neighborhood has been listed for sale at approximately $2.7 million.

A Knox County man’s constitutional protections against double jeopardy were not violated when he was convicted at trial after initially accepting a plea deal through a method not authorized by Ohio law, the state Supreme Court ruled.

Republican Sen. Jon Husted, Democrat Sherrod Brown, Libertarian Bill Redpath and independent Greg Levy are competing in the Nov. 3 special election.

A Central Ohio drag strip is on the market as businesses tied to its owner are locked in a multi-million-dollar legal battle with businesses in Elon Musk’s SpaceX artificial intelligence operation over data center construction. 

On Thursday, the Ohio Power Siting Board will consider public testimony for a proposed gas plant in New Albany to power neighboring data centers.