The discovery was almost embarrassingly simple: an AI system, tasked with auditing legacy code, found critical security flaws in PHP that had been hiding in plain sight since the early 2000s. Within hours of the disclosure, Amazon reported it had already been attacked. Now websites are going dark voluntarily as administrators rush to apply patches before malicious actors exploit what security researchers are calling one of the most widespread vulnerabilities in internet history.

PHP is not glamorous. It is not the language of choice for Silicon Valley's brightest or the subject of breathless conference keynotes. It is, however, the backbone of roughly 77% of all websites whose server-side language is known — including WordPress, which alone powers more than 40% of the web. When PHP has a problem, the internet has a problem.

The AI auditor

The vulnerabilities were uncovered by an automated security analysis system — the kind of tool that has become increasingly common as AI capabilities have matured. What makes this case notable is not that AI found bugs, but that it found bugs that had evaded two decades of human review. The flaws existed in PHP's core handling of certain input types, creating pathways for remote code execution that attackers could exploit without authentication.

Government security agencies in the UK, US, and Australia issued coordinated warnings urging immediate action. The UK's National Cyber Security Centre took the unusual step of advising organisations to take affected systems offline entirely if patches could not be applied within hours. Several major e-commerce platforms complied, preferring downtime to breach.

The scramble

Amazon disclosed that it had detected exploitation attempts before the public warning was issued, suggesting that sophisticated threat actors had either discovered the vulnerabilities independently or obtained early access to the disclosure. The company says it has patched its systems, but the admission underscores a troubling reality: in the window between discovery and patch deployment, attackers have the advantage.

For smaller organisations — the countless businesses running WordPress sites, legacy e-commerce platforms, and internal tools built on PHP years ago — the challenge is more acute. Many lack dedicated security teams. Some are running versions of PHP that are no longer officially supported. The patch exists, but applying it requires expertise that not every organisation possesses.

The deeper question

This episode will inevitably fuel the debate over AI's role in security. Proponents will point to it as vindication: here is proof that machine analysis can surface risks that human reviewers miss. Critics will note that the same AI capabilities that find vulnerabilities can also be used to exploit them, and that the compressed timeline between discovery and attack leaves defenders perpetually behind.

What is harder to dispute is that the web's infrastructure is older, more fragile, and more interdependent than most users realise. PHP's unglamorous ubiquity is precisely what makes this moment so serious. The language's dominance was never the result of technical superiority; it was the result of accessibility and inertia. Now that inertia has a cost.

Our take

The most striking detail is not that the flaws existed — legacy code always harbours surprises — but that they survived this long. PHP has been scrutinised by countless developers, security researchers, and automated tools over the years. That an AI could waltz in and find critical vulnerabilities in weeks suggests we have been overestimating human review and underestimating the sheer volume of code that underpins modern life. The lesson is not that AI will save us. It is that we have been building on foundations we never properly inspected.