PHP flaw exposes internet infrastructure as AI speeds vulnerability discovery

This week’s emergency disclosure of long-standing vulnerabilities in PHP underscored how fragile parts of the internet’s open-source foundation can be, especially as AI tools make it easier to find and exploit weaknesses at scale. PHP, a decades-old open-source programming language, powers a large share of the web and underpins popular content-management platforms such as WordPress and Drupal, affecting tens of millions of websites. Once the vulnerabilities were revealed, site owners faced an urgent choice: patch immediately or shut sites down if they could not quickly deploy updates. The episode was discussed on TechCrunch’s Equity podcast by Kirsten Korosec, Sean O’Kane and Anthony Ha, who characterized the incident as a reckoning over the internet’s dependence on under-maintained infrastructure. A critical detail was corrected during the discussion: the PHP flaws were identified by human researchers participating in OpenAI and Wiz’s Hack the Planet initiative, not by AI systems acting autonomously. The researchers nevertheless used AI to help analyze and exploit the bug, a distinction that sharpened the concern. If AI can assist in surfacing hidden flaws that persisted for years, attackers with similar tools may not wait for responsible disclosure to become public. That calculation helped create a dangerous window between discovery and defense. Public disclosure was seen as unavoidable because the affected code is so widely used, yet announcing the vulnerability risked triggering a scramble among attackers. The result was a chaotic security environment in which defenders, platform operators and hackers all moved simultaneously. Cloudflare Chief Executive Matthew Prince said there were millions of attempted exploits against one related PHP attack surface, while Amazon said its decoy network detected exploitation attempts even before the issue was widely publicized. The episode revealed a stark divide: major technology companies can monitor traffic, deploy honeypots and coordinate rapid responses, but many smaller businesses, government sites and hobbyist projects may lack the resources to do the same. The incident also raised concerns about the collateral damage of mass takedowns. When owners respond by shutting sites down, users face broken links, lost historical pages and reduced access to public information. Commentators worried this could become a recurring pattern if new generations of AI tools accelerate the discovery of older, obscure flaws in the digital plumbing. At the same time, defenders may benefit from similar technologies, using AI to stress-test software, scan codebases and identify vulnerable dependencies before attackers do. More broadly, the PHP episode illustrated an emerging cybersecurity paradox. AI is becoming both a tool for security researchers and a potential amplifier for attackers, but the internet’s response process remains uneven. When critical flaws are buried in widely used open-source projects, responsible disclosure can turn into a race against exploitation, because there is no practical way to notify every website owner, server operator or downstream user in time. For now, the lesson is less about any single bug than about structural exposure: large portions of the web still rely on aging software, often maintained by small or under-resourced groups, and are increasingly vulnerable to automated, AI-assisted probing.