PHP, one of the core technologies under the modern internet, is under attack. It could expose up to 40% of the sites out there.
PHP, one of the core technologies under the modern internet, is under attack. It could expose up to 40% of the sites out there.
PHP is 31 years old. It was built in 1995 to run a personal homepage, which is where the letters come from. Today it runs about 70% of websites whose server-side language can be identified. WordPress alone is about 40% of the web, and WordPress runs on PHP. So do Drupal and Magento. Wikipedia is a PHP site too.
On Tuesday, the PHP Foundation warned of two critical flaws in PHP itself. Not a plugin, not a theme: the base language. A crafted request makes PHP corrupt its own memory as the request fails. From there, an attacker with no login and no account can take over and run code on the server.
These bugs sat in the code base for more than a decade. AI found them. Then the clock ran fast. Amazon's honeypots saw exploitation attempts on October 17, four days before disclosure. Exploit details leaked before patches shipped. Cloudflare counted thousands of attacks before the announcement, tens of thousands within 45 minutes, and millions within hours.
AI doesn't just find the bug. It turns the patch into a working exploit, then races the fix.
Patches shipped Wednesday for supported versions. The real story is the tail. By Qualys's count, 71% of PHP installs with a known version run end-of-life branches that get no official release.
The internet runs on old code, maintained by people who may have moved on years ago. AI has collapsed the time from flaw to live exploit from weeks to minutes. The patch clock has changed, and everything built on top of it has to change too.
This won't be the last time security teams race an attack spread with AI's help. The good news: this time, AI is helping stop it too. Watch the fight between white hat and black hat AI. It will shape the internet.