AI-assisted discovery of PHP flaws exposes internet's aging infrastructure

A decades-old flaw surfaces

A significant security vulnerability was recently discovered in PHP, an open-source programming language that has been a staple of web development for years. While the flaw is relatively new to the public eye, it has actually existed within the code for decades. This means that a massive portion of the internet has been running on insecure foundations without the owners' knowledge.

The discovery was made during a collaborative effort involving human researchers from OpenAI and Wiz, a security company now owned by Google. These researchers used large language models (LLMs) to help identify and exploit the bug. Because AI can now be used to find these types of deep-seated issues, the companies felt it was necessary to announce the vulnerability publicly so that owners could begin fixing it.

The sudden disclosure created a high-pressure situation for web administrators. Because the flaw is so severe, the recommendation for many site owners is to take their websites offline entirely if they cannot apply a security patch immediately. This has led to a visible scramble to secure infrastructure that many people do not even realize they are using.

The backbone of the web

PHP is not just a niche language; it is a primary building block for the modern web. It serves as a core ingredient for popular content management systems (CMS) like WordPress and Drupal. Because these platforms are so widely used, the vulnerability affects approximately 70% of all websites on the internet.

This scale makes the issue much more significant than a typical software bug. When a flaw exists in a language as fundamental as PHP, it creates a ripple effect across tens of millions of different domains. This includes everything from small neighborhood blogs and personal hobby sites to larger corporate and government platforms.

The sheer volume of affected sites means that the security community is facing a massive coordination challenge. While large corporations might have the resources to respond quickly, many smaller entities may lack the technical expertise or capital to manage such a complex update. This disparity creates a wide range of risk across the digital landscape.

The rise of AI-driven threats

The use of AI in this discovery highlights a new frontier in cybersecurity. While human researchers found the specific PHP flaw, the ability to use LLMs to identify such vulnerabilities means that malicious actors can also use these tools. This creates a situation where attackers can potentially automate the process of finding and exploiting

A new frontier in cybersecurity

The discovery of this flaw was a primary topic on TechCrunch’s Equity podcast, where hosts Kirsten Korosec and Sean O’Kane discussed the broader implications of what they called the PHP-ocalypse. They explored whether this incident marks the beginning of a trend where more aging, hidden vulnerabilities in the internet's infrastructure will be exposed by AI tools. The conversation centered on how these moments of sudden breakage reveal the fragile nature of our digital world.

O’Kane noted that over the last decade, there have been several instances where the internet nearly crumbled because a single person maintaining a small repository caught a nefarious issue. He suggested that the situation is changing because we are now multiplying that risk by billions. With the widespread availability of advanced software and the ability to task AI agents to perform specific goals, the speed and scale of finding these flaws will likely increase.

Infrastructure risks and link rot

The fallout of this vulnerability extends beyond immediate security risks to the long-term health of the web. Kirsten Korosec pointed out that as governments and companies shut down websites to prevent exploitation, it could lead to significant link rot. This means that historical data and pieces of history hosted on these sites may become permanently inaccessible to the public as they are taken offline rather than being patched.

The scale of the threat was underscored by Cloudflare CEO Matthew Prince, whose social media posts highlighted a scary escalation to millions of attempted hacks. Additionally, Amazon released a blog post confirming that their honeypot network—a decoy system used to monitor threats—detected exploitation attempts even before the vulnerability was publicly announced. These reports suggest that while well-capitalized companies have the tools to fight back, many smaller entities remain highly vulnerable.