PHP disclosure highlights the web’s difficult patching problem
A severe vulnerability affecting the open-source language PHP triggered urgent warnings for website owners to patch their systems or, where immediate updates were impossible, take sites offline. The incident matters because PHP is embedded in content-management ecosystems including WordPress and Drupal, which the discussion described as supporting roughly 70% of websites and tens of millions of sites.
On TechCrunch’s Equity podcast, Anthony Ha, Kirsten Korosec and Sean O’Kane examined what the episode reveals about internet infrastructure. The vulnerabilities were found by human researchers participating in OpenAI and Wiz’s Hack the Planet initiative. AI was used to exploit the bug, but the source explicitly notes that AI models did not discover these particular flaws.
A disclosure problem at internet scale
The urgency arose from the nature of the response: patch at once, or remove an affected website from service until it can be secured. PHP has been used to build a large share of the web for decades, making it difficult to identify every operator and quietly distribute a fix before attackers learn of the issue.
O’Kane described the event as a reckoning for infrastructure maintained through a mixture of widely deployed open-source components and uneven operational attention. In conventional vulnerability disclosure, researchers can often notify a single software supplier or a bounded group of users. A flaw in a technology as broadly deployed as PHP leaves no similarly contained channel for reaching every site owner.
Exploitation began quickly
The podcast discussion also focused on the speed with which public information can be turned into attacks. Cloudflare chief executive Matthew Prince reported an escalation to millions of attempted PHP2Shell hacks. Amazon, which operates a honeypot, or decoy, network, said it had observed attempts to exploit the vulnerability before the public announcement.
Those signals distinguish organisations with dedicated security teams and monitoring infrastructure from smaller businesses, public bodies and neglected sites. Korosec also raised the prospect that some operators may close sites rather than patch them, increasing link rot and potentially removing online material that has continuing historical or local value.
AI changes the defensive timetable
The source frames large language models and AI agents as tools that could make vulnerability research and exploitation easier to scale. It does not claim that they caused this PHP discovery. Instead, the concern is that increasingly capable software may reduce the effort needed to search for weaknesses or operationalise attacks once a weakness becomes known.
For businesses, the practical implication is to know which public services depend on PHP and other foundational components before an emergency arrives. Maintaining an asset inventory, assigning clear service ownership, preparing patch and rollback procedures, and monitoring for exploitation can make the choice between a rapid update and an outage more deliberate when a serious disclosure occurs.