PHP: The bugs putting millions of websites at risk

Vulnerabilities found in a decades-old open-source web technology almost “broke the internet” last week, said Zack Whittaker in TechCrunch. The existence of bugs in PHP, a 31-year-old programming language used by roughly 70% of all websites and web apps worldwide, had been known for years “but weren’t considered exploitable.” That changed with AI. Security researchers using frontier OpenAI models reported that they “found a way” to weaponize those flaws, raising the risk that hackers could “break into any unpatched system on the internet without needing a password or any other credential.” The researchers notified the PHP Foundation, which released patches to fix the bugs—but companies still must race to update their websites before any hackers break into them. Matthew Prince, the chief executive of cybersecurity giant Cloudflare, said there have been “an exponential number of attempts to exploit the bugs following their disclosure.” It’s likely we’re not yet “out of the danger zone.”

“This is the cyber equivalent of an unexploded bomb,” said Zoe Kleinman in BBC.com. The weaknesses in PHP have been “quietly resting there for years”—until AI arrived and “the clock started ticking.” So far, the bomb “remains intact,” with no reported incidents, though it may be a while before the full extent of the damage is clear. Web developers will need “thoughts, prayers, and maybe a strong coffee” to keep their systems safe. The welfare of the entire internet comes down to one man, said Charlie Warzel in The Atlantic. Ondrej Sury, who lives in the Czech Republic, is responsible for maintaining and automating the patches for PHP. He is an “unsung hero,” and a reminder of how much of the internet’s infrastructure “is maintained by small crews of volunteers”—against an army of bots.

That’s why it will take “more than a handful of exhausted developers to keep us safe,” said Chris Stokel-Walker in The Guardian. The PHP Foundation, a nonprofit group of users, says developers identified the issue in 2024, but it was “too expensive and too tricky to fix.” There’s an easy solution here. Big Tech companies make billions of dollars from open-source software they essentially “get for nothing.” They could easily allocate resources to keep their platforms’ foundations from collapsing. Unless more companies act, this is only the beginning, said Matteo Wong in The Atlantic. “More websites will be defaced, more personal information will be stolen, and ransomware will proliferate” as AI-powered hacking matures. Organizations that have been “lulled into a false sense of security”— relying on older software and the idea that only a few skilled hackers could get access—should be “waking up from a trance” now that anyone can deploy thousands of AI agents to sniff out vulnerabilities and automate attacks. By next year, PHP-ocalypse may be “remembered as normal, or even tame.”

The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

Join more than 350,000 subscribers and keep yourself informed with a selection of The Week’s most interesting, enlightening and entertaining stories - plus daily puzzles.

Join more than 350,000 subscribers and keep yourself informed with a selection of The Week’s most interesting, enlightening and entertaining stories - plus daily puzzles.

Sign up