Decades-Old PHP Flaw Exposes Internet’s Fragile Foundation

The discovery of serious PHP vulnerabilities that existed undetected for years has sparked a debate among tech leaders about whether the internet’s underlying infrastructure can survive an era of AI-powered vulnerability research.

On a recent episode of TechCrunch’s Equity podcast, journalists and observers examined what happens when antiquated open source code, which powers the majority of the web, meets modern AI capabilities for security testing. The immediate crisis involved PHP flaws so critical that website owners faced an ultimatum: patch immediately or take their sites offline entirely.

When Ancient Code Meets Modern Tools

The Vulnerability That Escaped Detection

The PHP vulnerabilities in question have been present in the programming language for decades, yet nobody had identified them until recently. Researchers participating in OpenAI and Wiz’s (now Google-owned) Hack the Planet initiative discovered the flaws and used AI tools to demonstrate how they could be exploited. The concern articulated by tech leaders centers on a simple reality: if established security researchers could uncover these issues using AI, so can adversaries with malicious intent.

The Speed of Exploitation

The pace at which the vulnerability spread after initial disclosure caught many by surprise. Cloudflare CEO Matthew Prince documented millions of attempted PHP2Shell exploits occurring in real time. Amazon, using honeypot networks to detect intrusions, recorded exploitation attempts even before the vulnerability became public knowledge. These developments underscored how quickly attackers mobilize once a foundational flaw becomes known.

AI as an Accelerant

The broader technological question involves how large language models and AI agents change the equation for finding security gaps. Sean O’Kane, during the TechCrunch discussion, framed the issue starkly: “When you really get down to the bone level of the internet, it is held together with glue and dreams.” With AI tools now widely accessible, the calculus shifts from whether vulnerabilities will be found to when and by whom.

The Scale of Risk

Read also: 1Password Lets AI Agents Log In Without Seeing Your Passwords · Railway platform warns users to rotate keys after cyberattack · Apple Updates App Store Rules to Ban Bait-and-Switch Nudify Apps

PHP underpins approximately 70 percent of websites, with millions of installations running on WordPress, Drupal, and other platforms built on this decades-old language. The breadth of exposure means that a single vulnerability in PHP doesn’t affect a handful of sites, it threatens a vast swath of the public internet, from major publishers to small neighborhood websites to government portals.

This concentration of risk on a single open source foundation became a focal point of concern. Kirsten Korosec, during the podcast, noted that many website operators don’t even realize their infrastructure depends on PHP. The anonymity of the dependency compounds the problem: there’s no clear chain of custody for how patches propagate through millions of installations.

The Disclosure Dilemma

Breaking the Embargo

The vulnerability disclosure process typically relies on controlled information flow: researchers notify the affected vendor, a patch window opens, and then the public learns about it. But when an issue affects millions of websites without clear individual contact points, that system breaks down. In this case, someone leaked the vulnerability details before the embargo lifted, triggering a race among attackers to exploit PHP2Shell before patches could be deployed.

The Impossible Choice

Security teams faced an immediate dilemma: update immediately without testing, or temporarily disable websites until patches could be validated. Websites that took the latter path created what Korosec termed “link rot”: permanent loss of historical content and broken references across the internet. This collateral damage persists even after the underlying vulnerability is remedied.

The Companies That Could Respond

Amazon and Cloudflare possessed the resources and personnel to track the exploitation in real time. Most website operators did not. This asymmetry between well-capitalized tech infrastructure companies and the millions of smaller websites that run on the same PHP foundation exposed a fundamental inequity: large players can deploy honeypots and intrusion detection systems; smaller operators patch blindly or go dark.

AI as a Double-Edged Sword

The irony underlying this crisis is that the same AI capabilities used to discover the vulnerability also enable faster exploitation by attackers. Large language models and AI agents can be tasked with identifying patterns that might indicate security gaps. OpenAI, Google’s Wiz team, and other security researchers with access to advanced AI have deployed these tools constructively, but the tooling is not exclusive to defense.

O’Kane pointed out that over the past decade, internet infrastructure has repeatedly avoided collapse through the intervention of individuals maintaining small projects as hobbies. A single maintainer finding a bug at the right moment has, multiple times, averted larger outages. A fundamental shift in the threat model emerges from this scenario: sophisticated AI agents can autonomously search for, report, or quietly exploit vulnerabilities without human intervention or detection.

What Comes Next

Korosec raised the question of whether this incident catalyzes the creation of new defensive startups or accelerates adoption of open source security tools. The problem is too large for any single vendor to solve unilaterally, yet the incentives for coordinated global patching remain weak. Website owners lack unified visibility into their dependency on PHP and its security status.

The conversation among tech leaders also hinted at a creeping anxiety about the broader internet infrastructure. If PHP, used by the majority of websites, carried an exploitable vulnerability for decades without detection, what else lies dormant in the layers beneath the visible web? The assumption that legacy open source code has been audited thoroughly may prove false once AI-powered security scanning becomes routine.

The PHP crisis is, by this reading, a preview of conflicts to come: between the pace at which AI can discover vulnerabilities and the speed at which globally distributed infrastructure can respond; between the need for urgent disclosure and the impossibility of coordinating patches across millions of independent operators; and between defenders who have institutional resources and the vast majority of websites that do not.

Source: TechCrunch