An OpenAI model uncovered two critical PHP flaws, triggering a global update race that revealed how fragile and under resourced the internet’s foundational software has become. By Omar Gallaga.
Last week, software engineers worldwide scrambled to patch their websites’ backends after a team using an OpenAI model discovered two major vulnerabilities in PHP, the open-source scripting language that underpins as many as 70% of websites globally. Shortly after alerts issued, new PHP versions shipped and site operators were urged to update. Some government websites went dark in Europe during the rollout, but for much of the web, applying the fixes was left to individual owners.
The deeper story emerged from the PHP Foundation itself. Reuters reported the nonprofit, formed in 2021 to coordinate researchers and cybersecurity firms against crises like this, runs with just one full-time staff member. Executive Director Elizabeth Barron said she works with about 14 part-time contractors and unpaid board members, noting that AI-generated threats have doubled the demand to change PHP code while contributor numbers have not. “It is clear PHP is severely underfunded,” she said.
Awareness gaps compound the problem. A Network Solutions survey of 121 small business owners found 45% had never heard of PHP and 71% didn’t know if their sites used it. Principal systems architect Rick Radinger said owners often assume hosting providers will handle fixes.
Infrastructure companies moved anyway. Cloudflare deployed new web application firewall protections and launched a PHP Capture the Flag contest on HackerOne with cash prizes from $100 to $10,000, while GoDaddy updated managed hosting without requiring owner action.
For users, the vulnerability cannot be fixed by changing passwords or browsers—it lives on the site’s server. As PHP approaches its fourth decade, this scramble suggests many aging tools, from JavaScript to SQL databases, will keep surfacing vulnerabilities unless the web’s neglected maintenance infrastructure is addressed. Nice one!
[Read More]