PHP flaw forces patch-or-offline response, exposing web’s open-source reliance

The vulnerabilities are in PHP, officially Hypertext Preprocessor, an open-source language that underpins content management systems used by WordPress, Drupal and about 70% of websites, or tens of millions of sites, according to the TechCrunch report. The flaw had existed for decades without being known, the report said. The warning told site owners to patch at once, and if they could not update, to take sites down.

On TechCrunch’s Equity podcast, Kirsten Korosec, Sean O’Kane and Anthony Ha discussed what O’Kane called a 'real reckoning moment.' O’Kane said that at the bone level, the internet is 'held together by glue and dreams,' and that broad access to large language models and AI agents will make it easier to find such vulnerabilities. TechCrunch said the specific PHP vulnerabilities were found by human researchers, not AI models.

The report also contained a correction: TechCrunch initially described the bugs as found by big AI companies including Wiz, now owned by Google, using LLMs. It later corrected that human researchers participating in OpenAI and Wiz’s Hack the Planet initiative found the vulnerabilities, though they used AI to exploit the bug. The podcast segment likewise said human researchers, not AI models, found the specific flaws.

Korosec focused on scale and collateral damage. She said many people do not realize their sites run PHP, and she raised the prospect of link rot as companies, governments and small neighborhood sites shut down rather than patch. She also said the incident made her wonder what other decades-old bad software might be exploited, and she cited concerns that banks could be exploited and that data and privacy risks feel bigger than can be fixed right now.

O’Kane described two things happening at once: labs and companies including Google and OpenAI had people search for vulnerabilities, while others rushed to take advantage of them, prompting governments and popular websites to go offline briefly while fixes were applied. He said the episode would reveal the downside risk of building so much of the internet on open-source technology such as PHP.

Anthony Ha said the striking part was that the vulnerability was not new and had existed in PHP for decades. He said the calculation behind the warning was that if the flaw could be found with LLMs, others could find it too, but the only way to distribute a patch was to announce the vulnerability. That produced the panicked instruction to patch immediately or take a site down, he said.