Trump-Ordered Alaska Senate Lawsuit and the PHP Security Flaws

Sam The Justice Department has gone to court over a Senate race, and the lawsuit is aimed at the moment an election result becomes official, not at the voting itself. That's a strange target, and it's why this is worth a few minutes. Maya, what was filed, and where?

Maya The department filed in federal court in Anchorage on Thursday, October 22, 2026. It wants to stop Alaska officials from certifying the results of the November 3 U.S. Senate election if the Republican incumbent loses under conditions the department attributes to voter confusion. The next day, Friday, October 23, President Trump told reporters in Florida that he had ordered the filing. He said he was the one who told them to do it.

Sam Confusion about what, though? I can't picture how a voter ends up mixing up two candidates on a ballot, unless the names are close to each other.

Maya The names are close. The incumbent is Republican Senator Dan S. Sullivan, who has held the seat since 2015. He's running against Democrat Mary Peltola, a former U.S. representative. Two other candidates advanced under Alaska's top-four primary system, where the four best finishers in the primary move on to the general election. One of them is Daniel J. Sullivan Jr., a retired teacher from Petersburg. He's a registered Republican, but he appears on the ballot with no party label.

Sam That sounds like a recipe for a mix-up. But the senator is the one with the long record, so I'd guess the ballot tells voters which Sullivan is which.

Maya It does. The senator is labeled as a registered Republican and as the incumbent. The Justice Department's complaint alleges that Daniel J. Sullivan entered the race as a Republican to mislead the senator's supporters, and that the sole purpose of his candidacy is to help Peltola by reducing the senator's vote. The suit asks the court to block certification of any outcome that may have been affected by confusion, pending an investigation into whether votes for one candidate were meant for another.

Sam Block certification of any outcome that might have been affected? That's a wide net. How would a judge even decide whether the confusion mattered?

Maya The complaint offers a test. It asks a judge to treat a certification as unlawful if the senator loses but would have won had every vote for Daniel J. Sullivan gone to the senator instead, and the ranked-choice process then run. Ranked-choice voting means voters rank candidates, and the lowest finisher is eliminated, with those ballots moving to their next choice. Alaska officials expect that tabulation to begin November 18, after the deadline for overseas ballots.

Sam So the argument runs on a what-if, imagining one candidate's votes handed to another. That seems like a very hypothetical thing to put in front of a court.

Maya Several election-law specialists rejected the theory. Derek Muller, a professor at Notre Dame Law School, told CNN it was strange and unusual, and that he had never seen the preamble of the voter-registration statute used this way. A department spokesperson said the suit was brought under the National Voter Registration Act to protect the integrity of the process, and that the Alaska Division of Elections had already determined the candidacy was meant to mislead voters.

Sam Hold on. If the state's own elections division already decided that, why is the candidate still on the ballot at all?

Maya The division did decide that. On June 15, led by a Republican director, it removed him, concluding the candidacy wasn't filed in good faith. On June 26, Anchorage Superior Court Judge Thomas Matthews reversed that, writing that the division had invented a good-faith test found nowhere in the Constitution, state law, or its own regulations. The Alaska Supreme Court affirmed on June 29, hours before primary ballots were to be printed.

Sam Zooming out from the courtroom for a moment: this is about who controls the Senate, not just one seat. What does the chamber math look like going into November 3, and where does Alaska fit into it? I'd like to understand why this one race draws so much attention.

Maya CNN reported that Democrats need a net gain of four seats to take the Senate, and Alaska is one of the Republican-held seats they hope to flip. Reuters described Republicans as narrowly controlling both chambers going into the election.

Sam Close is the word I keep hearing. Before the lawsuit was filed, were any polls showing a clear leader in Alaska, or was it a toss-up from the start?

Maya Recent public polls, all taken before the suit, show a close contest. Rasmussen Reports surveyed 775 likely Alaska voters from October 12 to 15. Peltola had 44 percent, Senator Sullivan 42, Daniel J. Sullivan 3, and Heikes 4. The margin of error was plus or minus 3 points, and second-choice preferences were nearly even. The New York Times/Siena poll, reported by Newsweek, had Peltola at 50 and Sullivan at 43, with a margin of 5.1 points.

Sam A two-point gap with a three-point margin of error sounds like a coin flip to me. I'd guess the other polls look the same, with nobody clearly ahead.

Maya Mostly, yes. Surveys from InsiderAdvantage, Public Policy Polling, Alaska Survey Research, and Data for Progress also put the race within a few points. Sometimes Peltola leads after a simulated ranked-choice count, meaning the pollster reruns the elimination rounds on the ranked answers respondents gave. Other times it is essentially tied. Aggregators, which average many polls together, show small Peltola leads in the low single digits. Those averages are not official results, and they depend on which polls are included.

Sam Does the timing matter here? If people are already voting, I'd wonder what a certification fight does to ballots that are already cast.

Maya Early voting was already underway when the suit was filed. That's part of why the timing draws attention: the request comes before any votes are counted, and the count itself is not expected to begin until November 18.

Sam Back to the ranked-choice count, then. If a voter ranks up to four candidates, how does a mix-up between the two similar names actually play out in the tally? Does it always cost the senator a vote?

Maya Not always. If no one has a majority of first-choice votes, the last-place candidate is eliminated and those ballots move to each voter's next choice still in the race. That repeats until someone has a majority. CNN noted that a voter who ranks both men with the same name can still have the vote reach the incumbent if the other is eliminated, which can limit the effect of a pure name mix-up. The department argues that some voters may rank the wrong one higher, or leave the senator off entirely.

Sam Then I'm curious how a court would sort the mistaken ballots from the intentional ones. A ballot is just a ballot. Is there any mark on it that says what the voter meant?

Maya No, and that is the central difficulty. Derek Muller said that because ballots are co-mingled, there is no practical way after the fact to identify which votes were cast by mistake. The suit therefore asks a court to halt certification and investigate intent that the ballots themselves do not record.

Sam That sounds like the investigation would be chasing something nobody wrote down. How have the two sides described what the suit is for?

Maya Critics, including Senator Lisa Murkowski and the legal specialists quoted earlier, treat it as an attempt to reserve a federal veto over a state result only if the Republican loses. Supporters, including the department's own statement, frame it as protection against a candidacy the state elections office once called misleading. Whether any votes will in fact be cast in confusion, and whether a federal court will entertain the claim at all, is unknown.

Sam Switching to the other story now, which is about a programming language called PHP. I keep hearing that a flaw in it set off alarms around the world. Before we get into who found it, how far does this flaw reach, and why would one language matter so much?

Maya PHP is a language that runs on the server side of websites, and Wiz Research, which co-discovered the bugs, wrote that it powers 70 percent of websites. The bugs reach back to PHP 5.4, and Wiz said every PHP version of the last decade is affected by at least one of the issues. WordPress, Drupal, and Joomla all run on it.

Sam Seventy percent of the web is hard to picture. When a flaw hits that much of it, is there an earlier case where something this widespread broke, and does it compare?

Maya Wiz compared it to Heartbleed, a 2014 flaw in OpenSSL, the encryption software then used by about two-thirds of the web. The comparison is about reach, not mechanics. Heartbleed leaked memory from a cryptographic library. The PHP flaw, called PHP2Shell, can yield remote code execution, meaning an attacker runs their own commands inside the interpreter that runs the site.

Sam Running their own commands on someone's server sounds like handing over the keys. And something that central must have a big team behind it, I'd guess.

Maya It does not. A small foundation maintains PHP. Commentary noted in The Guardian observed that the PHP Foundation had 13 full- and part-time employees. The AI systems credited with helping find the bugs sit inside companies that have drawn billions in investment.

Sam Thirteen people for something running most of the web is hard to square. And the AI part intrigues me, because I assumed people found bugs like this by hand over a long time. Who found it, and when?

Maya Several parties did, in August 2026, months before the public knew. Ryan Austin of the California firm Calif, working inside OpenAI's Patch the Planet program, identified the first issue around August 1 and reported it to PHP on August 11. PHP confirmed his proof of concept, a small demonstration that the bug works, the next day. Wiz found the first flaw on August 19 and reported on August 24.

Sam Two teams landing on it within weeks of each other. What did the AI contribute, as opposed to the people?

Maya Wiz used its Atlas system with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and demonstrated unauthenticated code execution against Drupal and WordPress within days. Wiz wrote that proving exploitability took a chain of steps at the edge of what human researchers could practically achieve, and that the models substantially reduced that barrier. Calif said it used generally available models and no special harness. A researcher's knowledge of older PHP memory-limit bugs from 2004 pointed the model at the right code.

Sam That makes it sound like the person had the hunch and the model did the grinding. Still, if a related problem was spotted before, why wasn't it dealt with earlier?

Maya A related out-of-memory behavior had been noticed in a 2024 audit but was not fixed. The team lacked a working exploit and could not agree on a change. The public learned of the flaws on October 20, when details leaked on forums, on X, and through an early proof-of-concept video.

Sam So the secret got out before the patch was ready. That has to have shortened the time to fix things.

Maya PHP moved the patch forward from a planned October 22 release. Advisories appeared on GitHub on October 21 at 13:34 UTC, minutes before the announced window. Then the attack traffic came. Cloudflare's chief executive, Matthew Prince, wrote on X that the company saw thousands of exploit attempts in the 10 hours before announcement, tens of thousands in the 45 minutes after, and millions by the time of his post.

Sam Millions of attempts is a lot of knocking on doors. Does that mean millions of sites were broken into?

Maya That is contested. Prince's count and Amazon's "broadly exploited" language describe volume of tries, not a tally of compromised organizations. The UK's National Cyber Security Centre sent about 50,000 alerts and, as of The Guardian's October 22 report, had no reports of successful hacks. Cybersecurity minister Liz Lloyd told Parliament that 32 government services were taken offline, largely as a precaution. Finland shut its government's public web services, and in Japan banks, airlines, and rail operators suspended online services on October 22.

Sam Taking services offline as a precaution sounds like pulling the plug on a house so nobody can climb in a window. What about the sites that can't be fixed quickly?

Maya Older, unsupported PHP installs cannot take the official 8.2-and-later packages. VulnCheck and Censys counts put internet-facing PHP hosts in the low millions, with a large share on end-of-life versions. They depend on vendor backports, fixes adapted for old versions, that may never arrive. The fixes shipped October 21, and a related configuration issue was flagged on October 23.

Sam Both stories are a lot to carry, so for the close: what is the one thing to keep from each of them?

Maya On Alaska, the Justice Department has asked a federal court to block certification before any votes are counted, and whether a court will take the claim up is unknown, since the election has not been held. On PHP, the fixes shipped on October 21, and any site not on a fixed release or an equivalent vendor backport remains exposed.

Sam That's our show for today. A note on how it's made: this show is AI-generated, the voices are synthetic, and the facts come from the reporting named in the closing note, whose authors are not affiliated with this show. The next episode arrives tomorrow. Thanks for listening, Maya.

Maya Thank you, Sam, and thanks to everyone listening; I hope the next episode finds you well and that you check your own sites for updates in the meantime.

Sam Everything today came from reporting by CNN, Reuters, The New York Times, Newsweek, and The Guardian, along with research from Wiz Research, statements from Cloudflare and Amazon, and the incident page on Wikipedia.