Key takeaways
- A decades-old PHP vulnerability affecting 70 percent of websites forced millions of sites to patch immediately or go offline.
- AI-assisted vulnerability discovery by major research teams signals that adversaries will employ the same techniques to find exploits faster.
- The crisis revealed how core internet infrastructure depends on underfunded open source projects that can hide critical flaws for decades.
- Large companies like Amazon detected exploitation attempts within hours of disclosure, while smaller sites struggled to respond without dedicated security teams.
Website operators worldwide received an urgent directive this week: patch critical vulnerabilities in PHP immediately, or take their sites offline entirely. The announcement highlighted a foundational fragility in internet infrastructure. Much of the web runs on decades-old open source code, and artificial intelligence is making such vulnerabilities significantly easier to find.
The PHP Vulnerability Crisis
The vulnerabilities discovered in PHP had remained hidden for decades despite affecting an enormous swath of the internet. Researchers working with OpenAI and Wiz, now owned by Google, uncovered them as part of the “Hack the Planet” initiative. Though human researchers conducted the actual investigation, they employed AI tools in the process, raising alarms about how readily AI can accelerate the hunt for exploitable flaws.
Seventy Percent of the Web at Risk
PHP powers approximately 70 percent of all websites, particularly through WordPress, Drupal, and similar content management platforms. This means tens of millions of sites worldwide depend on the language, often without the site operators fully understanding the infrastructure running their sites. Most owners do not realize PHP sits at the foundation of their websites at all.
The combination of PHP’s omnipresence and the decades-old nature of the vulnerabilities created unprecedented scale. A single flaw affecting such a large portion of internet infrastructure transformed a routine security incident into an emergency requiring immediate action or complete shutdown.
Discovered Through Human Researchers and AI Tools
The human researchers participating in the “Hack the Planet” initiative used AI assistance in their investigation, successfully identifying flaws that had evaded detection for decades. This precedent raised immediate concerns among security experts and technology leaders: if well-resourced research teams can deploy AI to find vulnerabilities, adversaries will employ identical techniques.
With widespread access to large language models and autonomous AI agents, the advantage shifts dramatically. One person discovering a critical flaw accidentally becomes statistically unremarkable when thousands of AI systems can methodically probe codebases for weaknesses.
How Vulnerability Disclosure Went Wrong
The discovery created an impossible situation for security officials and researchers. Keeping the vulnerability secret risked allowing silent exploitation. Announcing it publicly meant triggering a race among attackers to strike before patches could be applied.
The Embargo Breaks, Attacks Accelerate
According to discussion on TechCrunch’s Equity podcast, some people obtained information ahead of the coordinated embargo, triggering what researchers describe as a rush among the hacker community. Cloudflare CEO Matthew Prince reported on social media seeing millions of attempted exploits targeting the PHP2Shell vulnerability appearing within hours of public disclosure. Amazon, operating a honeypot network designed to detect intrusions, documented exploitation attempts occurring even before official public announcement of the flaw.
The speed of attack illustrated how quickly adversaries move once they possess actionable information, and how difficult coordinated disclosure becomes for flaws affecting such a large installed base.
Internet Infrastructure Built on Fragility
The crisis exposed a structural vulnerability that transcends any single flaw. The internet backbone depends heavily on open source projects often maintained by small teams, volunteers, or underfunded developers. A single researcher catching a malicious actor targeting a minor repository can prevent catastrophic failures, but only if someone is paying attention.
According to participants in the TechCrunch discussion, the internet at its foundational level appears “held together with glue and dreams.” Open source projects like PHP receive security investment inversely proportional to their importance. A language powering 70 percent of websites may be maintained by far fewer people than its role demands, creating blind spots where vulnerabilities can hide indefinitely.
The Collateral Damage
Beyond immediate security threats lies another consequence rarely discussed: link rot. As websites went offline during patches or shut down to avoid exploitation, portions of the internet became inaccessible. Pages that had existed for years, referenced by other sites, and preserved in historical archives simply disappeared.
For governments, banks, and other institutions, the choice between disruption and risk of compromise felt forced. For historians, researchers, and anyone relying on specific web pages, the sudden disappearances represented permanent information loss.
One expert on the podcast noted a particularly poignant concern: “We’re going to have so much link rot and also websites that maybe had a little piece of history out there that aren’t gonna be accessible anymore.” The calculus of immediate security sometimes erases historical records.
The Larger Security Question
The PHP crisis likely represents an opening chapter rather than a standalone incident. As AI accelerates vulnerability discovery, the question becomes whether internet infrastructure can sustainably rely on open source maintained on volunteer time and thin budgets.
Technology leaders discussing the incident on TechCrunch’s Equity podcast noted the disparity in readiness. Large companies like Amazon possess capital, expertise, and dedicated teams to detect intrusions and respond effectively. Smaller websites, government institutions, and businesses lack equivalent resources, creating widening gaps in security resilience.
Whether this moment sparks meaningful investment in infrastructure security, or simply inaugurates a new era of AI-driven vulnerability discovery outpacing human patch capacity, remains uncertain. What is clear: the internet cannot indefinitely sustain the pressure of aging open source infrastructure meeting AI-accelerated threat discovery.
Source: TechCrunch
Frequently Asked Questions
How many websites were affected by the PHP vulnerability?
PHP powers approximately 70 percent of all websites, affecting tens of millions of sites that use platforms like WordPress and Drupal. Most site owners were unaware their sites even used PHP.
Who discovered the vulnerabilities and how?
Human researchers working with OpenAI and Wiz, owned by Google, discovered them through the 'Hack the Planet' initiative. They used AI tools to assist in identifying flaws that had remained hidden for decades.
How quickly did attacks begin after the vulnerability became public?
According to Cloudflare CEO Matthew Prince, millions of attempted exploits appeared within hours of disclosure. Amazon's honeypot network detected exploitation attempts even before the vulnerability was officially announced.
