PHP's Critical Flaw: How AI Uncovered a Decade-Old Vulnerability

The code that powers three-quarters of the internet just proved it cannot protect itself.

PHP runs roughly 75 percent of all identifiable websites, according to W3Techs. WordPress, which operates on PHP, accounts for approximately 43 percent of the entire web. On October 21, the PHP development team disclosed two critical vulnerabilities enabling remote code execution without any authentication. Attackers require no credentials, no login interface, no exploitable form field — merely a crafted request to gain control of a server.

Within hours, European institutions began pulling their websites offline. The Netherlands disabled its government portal, the national football federation, and several major party websites. Finland moved its public network services offline as a precaution. Denmark and Belgium followed with similar pre-emptive shutdowns of government and parliamentary sites. The patch had been scheduled for October 22. By October 20, however, details about the vulnerability had already appeared on an online bulletin board, forcing the team to release the fix a day early. Security researchers at Cloudflare confirmed that initial attack attempts were already appearing before the patch landed.

This is not a routine bug. It is a structural event — one that compresses years of slow-moving risk into a single afternoon.

AI found the flaw that humans missed for more than a decade.

The vulnerability had existed in PHP code for over ten years. Calif, a South Korean cybersecurity firm, used OpenAI’s GPT-5.6 Sol model to identify it. Wiz, a Google-backed cybersecurity company, independently discovered and reported both vulnerabilities using its own methods. Ami Rootwick, Wiz’s co-founder, described it as the most severe vulnerability he has ever seen discovered by AI, noting the code paths were too complex for human reviewers to trace without an enormous investment of time.

OpenAI stated in its own press comment that the combination of the flaw’s severity and PHP’s sheer scale made this one of the most impactful vulnerabilities the company has seen recently.

That detail matters more than it might appear. The traditional cybersecurity model operated on an asymmetry: defenders needed to find every flaw, while attackers needed to find only one. AI shrinks that gap in both directions. When the same tools that help security teams discover bugs can also help attackers map attack surfaces faster, the timeline between discovery and exploitation compresses dramatically. The PHP incident is an early case study in that shift — and it suggests we are entering an era where vulnerability discovery is no longer constrained by the bandwidth of human auditors.

The real problem is not PHP. It is dependency on PHP.

The technical fix exists. The harder question is deployment. Millions of websites — especially those running older versions of WordPress, Joomla, or custom PHP applications — sit behind servers that have not been updated for years. Many of these systems belong to small businesses, local governments, and nonprofit organizations that lack dedicated IT teams. Patching PHP is straightforward in principle. In practice, it requires testing that can break custom plugins, updating server configurations, and managing downtime — luxuries many smaller operators cannot afford.

The vulnerability allows unauthenticated remote code execution. That means any website still running an unpatched version of PHP is effectively an open door. There is no partial fix. There is no firewall workaround. The code itself is compromised at a fundamental level, and the patch only closes the door for those who install it.

This is why the European institutional shutdowns are significant beyond their immediate disruption. Governments are not fragile by design. If national governments are taking their sites offline because they cannot guarantee their PHP stack is patched, then the likelihood is high that countless smaller organizations never received the warning in time. The shutdowns were visible. The infections hiding in the background are not.

The second-order effects are already rippling outward.

Insurance markets are recalibrating. Cyber liability policies that once treated legacy software dependencies as an acceptable baseline risk are now being re-evaluated. Brokers report that underwriters are asking whether clients can demonstrate their PHP infrastructure meets current patch standards — a question that was not standard before this incident. Companies that cannot answer affirmatively may face higher premiums or exclusions that leave gaps exactly when they are most exposed.

Enterprise migration strategies are being compressed. Organizations that had been planning gradual PHP-to-modern-stack transitions over two to three years are now accelerating timelines. The question has shifted from “when should we migrate?” to “what is the minimum viable exposure window before we move?” Managed platforms like Shopify, Squarespace, and enterprise CMS solutions that abstract away PHP entirely are seeing increased inquiry volume from mid-market buyers who previously deferred the decision.

The regulatory angle is still forming but likely to solidify. The European Union’s Digital Operational Resilience Act already imposes requirements on financial sector technology suppliers. This incident will almost certainly broaden the conversation about whether critical digital infrastructure — especially public-facing government services — should be subject to mandatory dependency audits. The question is not whether regulation will follow, but how broadly it will apply.

Who wins, who loses, and what happens next.

The immediate losers are anyone running unpatched PHP infrastructure. That includes thousands of small business websites, regional government portals, and legacy enterprise systems that have not been migrated. The attackers who moved quickly before the patch dropped will have harvested data, planted backdoors, or gained footholds inside networks that now require forensic cleanup — a process that can cost organizations six figures per incident even before ransom demands or regulatory fines enter the equation.

The winners are less flattering. Threat intelligence firms and security vendors will see demand spike. Companies already operating on modern stacks — React backends, Go services, managed platforms — will look comparatively robust. PHP itself may face a reckoning similar to what Flash experienced two decades ago: the industry already knew the technology was a liability, but the transition was slow because the dependency was deep. That transition is now being forced by a single vulnerability rather than by gradual market pressure.

The longer-term consequence is harder to quantify but more consequential. The AI discovery of a decade-old critical flaw in a foundational language changes how security teams evaluate risk. If AI can find a flaw that thousands of human reviewers overlooked for ten years, then the assumption that “we would have caught this” is no longer defensible. Security audits will need to incorporate AI-driven analysis as a standard step, not an optional enhancement. Organizations that continue relying solely on traditional manual review cycles will be operating with systematically outdated risk assessments.

The patch arrived. The deadline has not.

The PHP community has released the fix. The attack surface is shrinking — but only for sites that update today. For the millions of operators who cannot, do not know they are vulnerable, or are waiting for a maintenance window that may never arrive, the clock is still running. The vulnerabilities are real. The attackers are real. And the gap between those two facts is measured in the time it takes to patch a language that the internet forgot how to update.