Severe PHP vulnerabilities forced unpatchable websites offline, and AI may find more like them

A patch-or-pull-the-plug warning

Earlier this week, website owners received an unusually blunt instruction: patch your PHP installations immediately, and if you cannot patch right away, take your site offline until you can. According to TechCrunch, which unpacked the episode on its Equity podcast, the guidance followed the disclosure of severe vulnerabilities in PHP, the open source programming language that quietly runs a large share of the web.

A flaw hidden for decades

As Equity co-host Anthony Ha explained on the show, the striking part is not that the bug is new — it is the opposite. By his account, the vulnerability had existed in PHP for decades without anyone noticing, embedded in a language that powers content management systems such as WordPress and Drupal. Fellow host Kirsten Korosec put the scale in perspective, estimating that PHP sits behind roughly 70% of websites, amounting to tens of millions of properties. Many of the people responsible for those sites, she added, likely have no idea PHP is part of their stack at all.

Attackers moved before the announcement

The disclosure itself did not go cleanly. Host Sean O'Kane noted that some parties got ahead of the coordinated release, which triggered a scramble among attackers, and that governments and well-known sites briefly took services offline while applying fixes. Cloudflare chief executive Matthew Prince, according to the podcast, posted that exploitation attempts had climbed into the millions. Amazon separately said in a blog post that its decoy honeypot network had caught attempts to exploit the flaw before it was publicly announced — a detail Korosec found telling, since it shows well-funded companies can see attacks coming while countless smaller sites, including government ones, have no comparable visibility.

Humans found the bug; AI helped break it

One widely shared detail needed correcting, and TechCrunch's own transcript flags it: although Ha initially said large AI labs had discovered the flaws with language models, the vulnerabilities were actually found by human researchers taking part in Hack the Planet, an initiative run by OpenAI and Wiz, the security firm Google now owns. AI was used to help exploit the bug, not to find it.

The urgency of the rollout still reflects the AI era, though. The reasoning, as the hosts described it, is that once skilled humans can surface a decades-old flaw, it is only a matter of time before others — including people wielding LLMs and AI agents — do the same, which argues for loud, fast disclosure rather than quiet coordination with a single vendor.

O'Kane framed the episode as a broader warning. For years, the internet has survived near-misses in which a lone hobbyist maintainer spotted something ominous just in time. Broad access to powerful models and autonomous agents, he argued, effectively multiplies the number of people capable of finding such flaws. He also acknowledged criticism of how the disclosure was handled, including what some saw as overly self-promotional messaging from OpenAI.

Why it matters

The incident exposes how much of the web rests on aging open source components maintained by a thin layer of people. When a foundational language like PHP turns out to carry an exploitable flaw for decades, there is no discreet way to warn millions of site owners, and the least-resourced ones — local governments, small businesses, hobby projects — are precisely those told to simply switch off. Korosec pointed to 404 Media's reporting on a likely consequence: sites that shut down rather than patch will accelerate link rot and erase chunks of web history. She also raised the larger question of how many other decades-old bugs remain buried, and how banks and privacy-sensitive systems would weather a similar discovery. The consensus on the show was that this is a starting point rather than a one-off, and possibly a market opening for security tooling built for an era when finding vulnerabilities becomes dramatically cheaper.