Two critical security holes in PHP, the programming language holding up millions of websites, just got dragged into daylight, and humans didn't find them. Researchers turned them up partly with an OpenAI model, which means flaws that sat there for decades got spotted by software while the people who wrote and reviewed the code walked right past them.
The Language Running Half Your Browser Tabs
Let's start with what PHP is, because the stakes depend on it. It's an open-source programming language that runs millions of websites. Not a niche tool. Not some forgotten corner of the internet. A load-bearing wall.
According to Axios, security officials are now sounding the alarm over two critical vulnerabilities in it, and the reporting describes them as problems hackers could easily exploit. Read that last part again. Not theoretically exploitable by a nation-state with a basement full of supercomputers. Easily exploitable.
The Machine Found What the Humans Didn't
Here's the part that should make every security team sit up. Researchers found the bugs partly with an OpenAI model. The reporting frames it as proof that AI can uncover critical flaws humans missed for decades.
Decades. Plural. Generations of developers, auditors, and volunteers have read this code, and two serious problems sat in plain sight the whole time. Then a model took a look and found them.
That's not an insult to the people who maintain open-source software, who are often underpaid and overworked and doing the Lord's work for a thank-you email. It's a statement about scale. A human can read only so much code before lunch. A machine doesn't get lunch.
Defenders Are Now on a Clock
The part of this story that should keep people up at night is the second half of the reporting's framing. This discovery raises the stakes for defenders racing to fix vulnerabilities before attackers can exploit them at machine speed.
Sit with that phrase. Machine speed. The old rhythm of security work was a bug gets found, a patch gets written, admins eventually get around to installing it, and everyone hopes the bad guys are slower than the paperwork. That rhythm assumed a certain pace of discovery.
The same tool that found these two bugs is available, in principle, to people who want to use them rather than fix them. A model that can find a decades-old hole for the good guys can find one for the other guys too. Nobody gets exclusive rights to a tool that reads code.
What We Don't Know Yet
The reporting available to us leaves some obvious questions open, and we're not going to pretend otherwise. The details on exactly how the bugs work, which versions are affected, and how quickly fixes are reaching the millions of sites that need them weren't part of what we had to work with.
That gap matters. A vulnerability announcement is only as useful as the patching that follows it, and patching across millions of websites is where good intentions go to die. Plenty of those sites are run by small businesses, hobbyists, and agencies that haven't touched their servers since the last administration. Maybe the one before that.
If you run anything on PHP, check with your host or your developer and ask the dull question. Are we patched? It's a boring question and a very good one.
One of the Most Consequential Discoveries Yet
The reporting calls this one of the most consequential cybersecurity discoveries yet made with AI. That's a notable claim given how much hype surrounds this technology, so treat it carefully.
Most AI announcements are a press release wearing a lab coat. This one is different because it's a concrete result with a concrete target. Two real flaws. A real language. Real security officials worried enough to say so out loud.
That's the difference between a demo and a consequence. The consequence is already here, and the people who need to respond to it are on a deadline nobody agreed to.
The Dingo Take
Decades. That's how long these two critical holes reportedly sat in PHP before a machine pointed at them and said, hey, what's this? Millions of websites. Decades of human eyes. And the thing that finally spotted the problem doesn't need sleep, doesn't need a salary, and doesn't get bored on line forty thousand.
Here's what bugs us, no pun intended. Everyone is going to spend the next week arguing about whether AI is good or bad for security, as if that's a toggle somebody gets to flip. It isn't. The tool exists. The only question is who points it at the code first, the people trying to fix things or the people trying to break them. Right now we're told defenders are in a race, and in a race you'd better hope you started early.
So patch your stuff. Ask your host. Stop treating security updates like a dentist appointment you'll reschedule forever. The bugs are real, the clock is running, and the attackers have just been handed a very fast intern.
Comments