AI Makes Decades-Old PHP Vulnerabilities Easier to Exploit

Thousands of attempts to exploit newly disclosed vulnerabilities in the PHP programming language were observed across the Cloudflare network in the 10 hours before the issue was publicly announced, according to CEO Matthew Prince. This number jumped to “hundreds of thousands” of attacks within two hours of disclosure, and “millions” by the following night, according to theverge.com.

The vulnerabilities, rated 9.2 out of 10 for severity by PHP developers, have existed in the language for roughly 20 years. However, security firm Wiz states that exploiting them previously required an “exceptionally complex chain of steps.” Powerful AI models are now making it much easier to turn these obscure bugs into dangerous exploits.

PHP underpins up to 70 percent of websites, including major platforms like Wikipedia, WordPress, and Drupal. Even some government agencies in the Netherlands and Finland temporarily took their sites offline as a precaution. The NSA Cybersecurity account and the UK’s National Cyber Security Center recommended that organizations take their systems offline if an immediate update was not possible.

Many older websites and services that are no longer actively maintained are at risk. Some, like the decade-old games World Quest and Save My Demonic World, are built on technology too old to receive updates, potentially forcing them offline permanently. OpenAI has shared a tool to help developers check for vulnerable PHP versions.

The AKUSO take: This is a reminder that even long-standing digital foundations can become suddenly vulnerable with new AI capabilities, affecting everything from major platforms to smaller, older sites.