Critical PHP vulnerabilities discovered in decades-old code powering majority of web
Human researchers participating in OpenAI and Wiz's Hack the Planet initiative found long-hidden security flaws in PHP, a foundational programming language used in approximately 70% of websites, forcing an urgent global patching effort.
What happened
Vulnerabilities in the open-source PHP programming language were discovered by human researchers participating in OpenAI and Wiz's Hack the Planet initiative, who used AI to help exploit the bugs. The flaws had existed in PHP for decades but went undetected until now. Website owners were told to immediately patch their sites or take them offline due to severity. The disclosure prompted a race among hackers to exploit the vulnerability before patches could be deployed. Some people breached the embargo on the vulnerability announcement, accelerating malicious activity.
Context
PHP is the foundation of content management systems like WordPress and Drupal, powering tens of millions of websites globally, used in approximately 70% of websites. The discovery raises questions about what other long-standing vulnerabilities exist in decades-old open-source software underpinning internet infrastructure. The incident highlights a structural tension: vulnerabilities in foundational, widely-used code cannot be patched discreetly the way company-specific software can be, creating a window of exposure when disclosure becomes necessary. With increasingly accessible large language models and AI agents capable of finding and exploiting security flaws, similar incidents may become more frequent. The forced takedowns of websites to prevent exploitation are creating link rot and loss of historical web content.