Why a 22-Year PHP Flaw Just Became a Global Cybersecurity Crisis

AI Just Made a 22-Year Bug a Live Weapon

For decades, the vulnerability lived in PHP — dormant, theoretical, invisible to every security team scanning the internet for threats. It was there, technically exploitable, but the chain of steps required to weaponize it was so complex that only the most patient and well-funded researchers could have navigated it. Until AI showed up.

This week, cybersecurity firm Wiz Research announced that OpenAI technology had been used to discover critical flaws in PHP, the programming language that powers roughly 70 percent of the world’s websites. The NSA called it one of the most impactful vulnerabilities in recent memory. The exploitation attempts, according to Cloudflare CEO Matthew Prince, began in the tens of thousands within the first 45 minutes of disclosure. By Thursday, those numbers had climbed into the millions.

What happened here is not just another bug report. It is a glimpse into a new phase of internet security, where AI does not merely assist researchers — it democratizes the ability to find and exploit flaws that once required years of specialized effort.

The Scale of What Is Running on PHP

PHP is often invisible to everyday users. You do not see it in your browser bar or on a website’s design. But behind the scenes, it is running everything from WordPress sites to government portals, banking interfaces, and healthcare systems. The language has been the backbone of the web since the mid-1990s, and millions of sites have never fully patched their PHP installations because the cost of updating code across legacy systems is so high.

That inertia is exactly what makes this moment dangerous. The vulnerabilities existed for years, perhaps decades. Nobody knew they were exploitable. Now the world knows, and the people building automated attack tools have known for far longer than the organizations still running old PHP versions on exposed servers.

Who Is Getting Hit First

The pattern emerging over the past few days is predictable and alarming. Dozens of British government services went offline. Finnish government sites followed. In France, many local government websites were briefly taken down. Japan’s Prime Minister Sanae Takaichi issued an urgent request, noting that temporarily suspending websites was an effective way to reduce risk when patches could not be applied quickly. China’s Industry Ministry ordered entities to review their security gaps. The U.K.’s National Cyber Security Center used language rarely seen outside active threat situations: “take immediate action.”

The common thread is urgency, not panic. These are not responses to confirmed mass breaches — yet. They are responses to the certainty that breaches are coming. Organizations that have not updated PHP are now in the crosshairs of automated scripts that do not need human direction to find them.

The AI Factor Changes Everything

Wiz Research was blunt about the role AI played. The organization said that demonstrating the exploitability of these PHP flaws required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” AI models, it said, “substantially reduced that barrier, turning a longstanding flaw into an exploit.”

In plain terms: the bug was always there. What was missing was the ability to connect the steps fast enough to prove it could be used in the wild. AI collapsed the time it would have taken a team of researchers years to compress into something the firm could validate in a fraction of the time.

This matters beyond PHP. The same pattern will repeat with other legacy systems across the internet — systems that were built when computing power was limited, when threat actors had fewer tools, and when a vulnerability of this complexity might have stayed theoretical for another decade. AI does not create the bugs. But it removes the bottleneck that kept many of them hidden.

Who Wins, Who Loses

The winners here are the organizations that had already modernized their infrastructure or that moved fast enough this week to apply the patches released by the PHP Foundation. Their systems are hardened. Their teams anticipated the kind of rapid exploitation that followed disclosure.

The losers are slower to react — and in cybersecurity, slowness is measured in hours, not days. Every server still running an unpatched version of PHP is now visible to attack infrastructure that is being built and refined in real time. The risk is not abstract. Successful exploitation allows attackers to take control of servers, steal sensitive data, and deface websites. The scale of exposure is defined by the 70 percent figure.

There is also a quieter loser: trust in the internet’s maintenance culture. The fact that a vulnerability of this severity could exist unpatched across so much of the web for so long is a structural problem, not a temporary one. Patching PHP is not glamorous work. It requires effort, coordination, and funding — resources that are often in short supply at the organizations that need them most.

What Comes Next

The NSA warned that heightened awareness should continue for weeks. That timeline is telling. It means the initial wave of exploitation is expected to persist well beyond the news cycle. Automated tools will continue to scan for vulnerable servers. New variants of the exploit will emerge. The patches exist, but distribution and installation lag behind discovery — always, and especially with legacy systems.

Cloudflare’s Matthew Prince observed the first surge live. The millions of attempts that followed were not launched by organized criminal gangs or nation-state hackers acting alone. They were launched by scripts, bots, and automated systems that now have a blueprint for the exploit. That blueprint will outlast the current headlines.

The broader lesson is stark. AI has lowered the barrier between theoretical vulnerability and real-world weaponization. For every PHP-style flaw, there are likely dozens more waiting in the code that runs the internet — flaws that human researchers may not have the time or tools to unlock. The patching pace needs to catch up to the discovery pace. Until it does, the next crisis will not wait for a news cycle to find it.