Story
Oct 23, 2026
AI Found PHP’s Flaw, but Old Internet Infrastructure Took the Hit
Security researchers and officials treated the PHP flaws as an urgent containment problem, while developers and small businesses saw the disruption as proof of how deeply fragile web infrastructure runs through daily life. AI delivered an early warning, but the response exposed a race between patching, disclosure and exploitation.
Researchers from Calif and Google-owned Wiz used advanced AI models to uncover two critical vulnerabilities in PHP, the decades-old language behind WordPress, Drupal and, by some estimates, roughly 70% of websites. OpenAI called the discovery “one of the most impactful security issues in recent memory,” while acknowledging the central tension: the same capabilities that find flaws can help attackers turn them into weapons.1
The danger was not entirely theoretical. Amazon said it had detected an attempted exploit four days before public disclosure and later warned the bugs were being “broadly exploited in the wild.” The NSA’s response was blunt: install the updates immediately—or take systems offline until they can be secured.2
On Wednesday, the PHP Foundation released patches, kicking off a worldwide shutdown-and-update scramble. Britain said 32 government services went offline as a precaution; Dutch digital-identity and public-service portals were affected; and sites in Germany, Japan and Finland also went dark. In Helsinki, developer Kalle Pusa described the outage’s human-scale impact: services are “woven into the fabric of our society,” and for two days “a lot of the fabric could be said to have been torn.”3
For defenders, the priority was speed. Cloudflare CEO Matthew Prince said observed exploit attempts rose from thousands before disclosure to millions afterward, underlining how little time administrators had to act.3 Yet Dataminr reported that, as of Thursday afternoon, it had seen scanning, fingerprinting and non-working exploits but “no known compromises”—a reminder that precautionary outages were meant to avert catastrophe, not evidence that every service had already been breached.4
The consequences were uneven. Large organizations could treat an interruption as a “speed bump,” said UK small-business provider Alistair Greaves; smaller firms, including his own, lost services for as long as seven hours.3 Older, unsupported PHP deployments face a harsher choice: patch if possible, or potentially disappear.
The response is now being automated too. Aravind Srinivas said his company was offering credits for a tool to check PHP sites and GitHub deployment configurations for exposure and prioritize fixes.
5 But one analysis framed the broader lesson starkly: defenders gained an AI-assisted head start this time; future incidents may offer far less room between discovery and attack.6