For years, PHP’s ubiquity was mostly invisible to the people browsing the web. Then AI-assisted researchers working with tools from OpenAI and Google uncovered serious, long-standing weaknesses in the scripting language, which is used by about 70% of websites.¹

The discovery turned a familiar software chore into an emergency. Last week, two critical bugs sent organisations scrambling to fix affected systems; some took websites offline rather than leave them exposed while patches were prepared.² The scale of the response reflected not only PHP’s reach, but the unnerving possibility that widely deployed, aging code may contain vulnerabilities that have simply gone unnoticed.

Researchers and the PHP team moved with OpenAI, Wiz and the Calif research group to coordinate repairs. But the incident also exposed the limits of that model. Tomer Schwartz, Wiz’s CTO for Exposure Management and AppSec, said the company “couldn’t have found these bugs without AI,” after custom tooling tested dozens of possible ideas over a weekend.²

That speed is the core tension. AI can give defenders a powerful way to inspect old code, but it can also accelerate the discovery—and potentially exploitation—of fresh vulnerabilities. One of the PHP bugs had sat “in plain sight for more than a decade” before changing conditions made it exploitable, according to the account of the response.²

For site operators, the immediate message is less futuristic: patch promptly, and check whether the software beneath a website has actually been updated. For the security industry, the PHP scare is a harsher lesson. Manual patching cannot scale if machines begin finding internet-wide flaws at machine speed.¹