AI Just Found Two Decades-Old Flaws That Could Compromise 70% of the Internet. Here's What That Means for Your Business.
AI researchers discovered two critical zero-day vulnerabilities in PHP that affect 70% of the world's websites. Governments worldwide took sites offline. Here's what every business leader needs to know right now.
This morning, government websites across Europe went dark. Wikipedia pulled supporting services offline. Japan's prime minister issued an urgent national advisory. The NSA told organizations to patch immediately - or shut their websites down until they could.
The cause: two critical vulnerabilities discovered in PHP, the programming language that powers roughly 70% of the world's websites.
If your organization runs a website, a customer portal, an e-commerce platform, or any web-based application, you need to understand what happened - and what to do about it.
What Is PHP and Why Does It Matter?
PHP is one of the most widely used programming languages in the history of the internet. It powers WordPress - the platform behind an estimated 43% of all websites. It runs Drupal, Joomla, Magento, MediaWiki (the engine behind Wikipedia), and countless custom web applications built over the past two decades.
If 70% of the internet sounds like an overstatement, it isn't. PHP is foundational infrastructure - the kind of software that sits underneath so many other systems that most people never think about it. Which is exactly why vulnerabilities in it are so dangerous.
What Were the Vulnerabilities?
Researchers at a cybersecurity firm called Calif, working under an OpenAI-funded initiative called Patch Planet, found two critical flaws in PHP using AI models - specifically OpenAI's GPT-5.6 Sol. Wiz, a Google-owned cybersecurity company, independently confirmed the findings using AI tools including Google's Gemini 4 Argon.
The flaws allow an attacker to access a web server without any authentication whatsoever - no username, no password required. Once in, they can do anything: steal data, modify website content, plant malware, or use your server as a launchpad for attacks on others.
Here's the part that should concern every business leader: these vulnerabilities had been sitting in PHP's code for years. Not months. Years. They weren't obvious bugs. They were subtle enough that human developers reviewing the code missed them repeatedly. It took AI - scanning at a speed and depth no human team could match - to find them.
The PHP Foundation's security engineer described the situation as the most serious PHP had faced in more than a decade, comparing it to Heartbleed, the 2014 flaw that triggered a worldwide emergency patching effort across millions of systems.
How Did This Become a Crisis?
Responsible disclosure processes exist for exactly this reason. When researchers find critical flaws, they notify the affected software maintainers privately, work together to build a fix, and coordinate a controlled public release with a patch ready to go. That's how this was supposed to unfold.
It didn't.
Details about the vulnerabilities leaked online on October 20th - a day before the planned patch release. Within hours, those details were circulating on hacking forums. Cybercriminals began using AI to reverse-engineer working exploit code from the leaked information. Cloudflare reported millions of hacking attempts on its network.
That forced the PHP Foundation to accelerate the timeline, releasing the patch early and urging organizations to update immediately - or take their systems offline until they could.
The result was the scene playing out globally today: government services going dark, infrastructure operators racing against active exploitation attempts, and security teams scrambling across time zones.
What This Means for Your Business
There are three layers to this story, and each one has implications for how you manage security going forward.
Layer one: The AI discovery. This isn't the first time AI has found critical vulnerabilities in foundational software, and it won't be the last. The number of software vulnerabilities identified in 2026 is on track to roughly double 2025's record total. AI has fundamentally changed the economics of vulnerability research - making it faster, cheaper, and accessible to both defenders and attackers. The window between a vulnerability existing and someone finding it is closing fast. OpenAI itself called this discovery "one of the most impactful vulnerabilities in recent memory" and noted it "marks a new phase, where AI can find security bugs with internet-scale impact."
Layer two: The patch gap. The PHP Foundation released a fix. The NSA, CISA, and governments worldwide issued urgent advisories. The question isn't whether a patch exists - it's whether your organization has the process to act on it in hours rather than weeks. The average enterprise patch cycle runs about 44 days, according to Verizon's DBIR. Cloudflare reported active exploitation attempts the same day details leaked. Forty-four days is not a viable response when attackers are moving within hours.
Layer three: The supply chain. Even if your organization doesn't run PHP directly, your vendors might. Your website hosting provider, your CMS platform, your e-commerce layer, your customer portal vendor, your development tools - any one of them could be running vulnerable PHP. You are responsible for understanding your exposure across your full technology supply chain, not just the systems you directly control.
Three Questions to Ask Your Team Right Now
First: Do we run PHP anywhere, directly or through a vendor? This requires a current inventory of your web properties, the platforms they run on, and your hosting environment. If you don't have that answer within the hour, that's a gap worth addressing beyond today's emergency.
Second: What's our patch SLA for critical vulnerabilities? Not the policy you wrote - what actually happens when a critical advisory lands? Who owns the response? Who has authority to take a system offline while a patch is applied? If those questions produce hesitation, your process needs attention.
Third: How would you know if someone had already exploited this before you patched? Patching closes the door, but it doesn't tell you whether someone walked through it already. If you patched today, that's necessary - but it's not sufficient. Review logs for unauthorized access attempts, unusual authentication patterns, or unexpected data transfers going back at least 48 hours.
The Bigger Picture
The NSA's message today was stark: update immediately or go offline. That's not the kind of guidance federal agencies issue lightly. When the intelligence community tells you to shut your website down rather than leave it exposed, they're signaling that active exploitation is real and the risk of being compromised outweighs the cost of downtime.
Most businesses will patch and move on. The ones that come out ahead are the ones that use moments like this to ask harder questions: How fast can we actually respond? What's our visibility into our own technology stack? And what's our plan if someone got in before we knew to look?
Those aren't questions for a security team alone. They're questions for leadership.
If you're not sure where your organization stands, TrustPoint Cyber can help you build the process - before the next global emergency makes the gap visible.
Ready to strengthen your security?
TrustPoint Cyber delivers Zero Trust architecture, incident response, managed security, and vCISO services — built for your business.