The PHP vulnerability exposed the internet’s uneven defenses

A flaw that stayed hidden

PHP has been used to build a significant part of the web, yet this vulnerability had existed for decades without being noticed. PHP also underlies content-management systems such as WordPress and Drupal. Kirsten Korosec said those systems are associated with roughly 70% of websites — tens of millions of resources.

The discovery came through OpenAI and Wiz’s “Hack the Planet” initiative. Anthony Ha initially thought large language models had found the flaws, then corrected himself: human researchers discovered them, while AI was used to exploit the bug.

That distinction matters. The story is not that AI independently uncovered a decades-old weakness. It is that AI can help turn a discovered vulnerability into an operational threat, while other models and agents may make the search for similar flaws easier.

During the same week, researchers at labs and companies including Google and OpenAI were looking for vulnerabilities, while others tried to use disclosed problems to break into websites. Authorities took sites offline, and some popular sites briefly shut down while specialists addressed the flaw.

Disclosure became a race

Once a vulnerability is public, defenders have to patch it — but disclosure can also give attackers a target. Ha said site owners had to move quickly: install the fix or close a site if an immediate update was not possible. The flaw was serious enough, he said, to warrant those steps.

Several people reportedly disclosed the vulnerability before the embargo ended, according to the podcast discussion. That set off a race among hackers. Sean O’Kane cited a post by Cloudflare CEO Matthew Prince reporting millions of attempts to exploit PHP2Shell.

The usual process of privately notifying a software maker becomes harder when the affected technology is fundamental to so much of the internet. There is no simple way to quietly alert every site owner. Korosec pointed to another risk: some owners may not even know their sites use PHP.

And when a site cannot be fixed, it may simply disappear. Korosec recalled a 404 Media report on “link rot,” in which companies, governments and even small local sites close pages rather than patch them. Old pages and pieces of history can vanish as a result.

Protection is uneven

Korosec cited Amazon as an example of what a well-resourced defender can do. The company has tools and specialists to monitor threats, and operates decoy systems that imitate real ones. She said Amazon detected attempts to exploit the vulnerability before it was publicly reported.

Many websites, including possible government resources, do not receive that level of attention. That gap is the more consequential part of the story: a patch can exist, and a capable company can spot an attack, without the people responsible for every affected site knowing what to do.

I think the episode is less a demonstration of AI discovering the internet’s weak points than a warning about who can act once those weak points are found. AI agents could multiply the number of searches for vulnerabilities, but there is no comparable system for reaching every site owner with a warning — or ensuring they can install a fix. The internet may get faster at finding its flaws before it gets better at repairing them.