AI Found a 20-Year-Old PHP Bug That Put 70% of the Web at Risk

What Happened

The Wall Street Journal broke a story that sent shockwaves through the security community: AI tools had discovered a critical vulnerability inside PHP — a technology that powers an estimated 70% of all websites on the internet. The vulnerability, hiding in the codebase for more than 20 years, could have allowed hackers to steal data, execute remote code, or launch wide-scale cyberattacks against any site running an unpatched version.

The PHP project team scrambled to issue patches. The NSA issued a public advisory. Government websites went dark. 4chan suspended comments. And security researchers around the world held their breath — because by the time the patches were released, exploit code had already been written.

The Bug That Hid for 20 Years

This wasn't a new bug. Security researchers had been circling the same area of the PHP codebase for years. They knew something was wrong — the code behaved strangely in ways that suggested a deeper issue — but nobody could turn it into a working exploit. A bug that causes a crash is annoying. A bug that lets someone run arbitrary code on your server is catastrophic. Nobody could bridge that gap.

The complexity of the vulnerability is part of why it survived so long. It wasn't an obvious mistake. It was the kind of subtle, deeply nested logic error that requires enormous patience and breadth of attention to trace through. The kind of thing that's easy to miss when you're a human developer skimming through legacy code.

How AI Found What Humans Couldn't

This summer, two security researchers took a different approach. Instead of manually combing through PHP internals, they pointed modern AI tools — specifically OpenAI's latest models — at the problem area. The AI did what humans couldn't do efficiently: it worked through the tedious, complex, long-form analysis required to trace the vulnerability from a vague anomaly into a confirmed, reproducible exploit.

As WSJ reporter Robert McMillan described it: "It would take a lot of work for a human to just be banging away for months and months to figure out what was going on. But an AI can do that sort of menial, complex, long-term task much more quickly than a human."

The Race Against the Clock

After the researchers disclosed the vulnerability privately, a coordinated patch release was planned. The story was under embargo — McMillan had it weeks before publishing, knowing that leaking even a hint of its existence could allow adversaries to use AI tools to independently recreate the exploit.

Then the information leaked. With details now circulating online, there was a mad rush to get patches out. The PHP project — a volunteer-run organization with just a handful of paid staff — moved their release date up by a full day. Meanwhile, Amazon confirmed that exploit code had already been written before the patches dropped. The window between "knowledge of the bug" and "weaponized exploit" had been measured in hours.

Who Was Affected

If your website runs PHP — and there's a reasonable chance it does — you were potentially at risk. PHP is so ubiquitous it's practically invisible. It was what a young Mark Zuckerberg used to build the early version of Facebook. It underpins WordPress, which itself powers roughly 43% of all websites. It runs deep in government infrastructure, content management systems, e-commerce platforms, forums, and hundreds of frameworks that developers have built their careers on.

One of the more unsettling aspects of this story is how many site owners don't even know they're running PHP. It's baked into so many hosting environments and CMS platforms that the average website owner simply never thinks about it. As McMillan put it:"There are a lot of sites that really — I don't think they even know that they have a problem."

What Should You Do Now

If you haven't already, the immediate action is straightforward:

The Bigger Picture: AI and Cybersecurity

This event marks a genuinely new chapter in the security landscape. AI isn't just a tool for writing code faster or answering questions — it's now capable of doing the slow, painstaking analytical work that has historically protected legacy systems by sheer human cognitive limitation.

The researchers who found this bug were operating defensively. But the same techniques are available to anyone. The race between defenders and attackers has always existed, but AI has just raised the speed limit for both sides dramatically. We should expect more discoveries like this — some made responsibly, some not.

The PHP project itself is a remarkable story within this story — a volunteer-run organisation with a handful of paid staff, carrying the weight of powering the majority of the internet. The people involved got into open source because they loved writing software, not because they wanted to coordinate global patch releases under extreme pressure with the entire internet watching. It's a reminder of how much critical infrastructure depends on communities that are chronically under-resourced.