Two vulnerabilities in PHP — the 30-year-old scripting language underpinning an estimated 70% of the world's websites — forced governments and businesses worldwide to take systems offline this week. The flaws sit in PHP's memory management and error handling, components so fundamental that nearly every web request touches them. Security vendor Hadrian dubbed the exploit chain PHP2Shell and reported exploitation happening at scale within hours of disclosure. The vulnerabilities allow an attacker to corrupt a server's memory through a crafted request, then pivot to the file system or database. WordPress, Drupal, Wikipedia, and Facebook all run on PHP. In Australia alone, 391 government websites use a Drupal-based platform called GovCMS. The attack surface is not a niche corner of the internet — it is the internet's load-bearing wall. The discovery story is itself a signal of a new era. The PHP Foundation used Anthropic's frontier model to scan its codebase, while OpenAI's Patch the Planet program independently found the same flaws around the same time as a human researcher in mid-August. AI did not create these vulnerabilities — they have likely existed for years — but AI collapsed the timeline for finding them from months or years to weeks. The same capability is now available to attackers. An embargo set for October 22 was blown early when exploit details began circulating on forums and social media. Amazon Threat Intelligence identified a PHP2Shell exploitation attempt against a honeypot four days before public disclosure, suggesting a threat actor had acquired exploit information independently. The embargo, designed to give defenders a head start, may have provided a false sense of security while sophisticated actors moved first. Patches are available, and many sites went dark briefly to apply them. But as Sophos's Don Smith noted, the real challenge is not installing a patch — it is finding every instance of PHP running across an organization's infrastructure. ANU professor Sigi Goode offered the sharper diagnosis: the sites that stayed online are the worry, because they are now visible targets that have not yet patched. The structural lesson is the one Randall Munroe drew years ago in XKCD #2347: modern digital infrastructure rests on projects maintained by vanishingly small teams. The PHP Foundation operates on donations and employs just 13 full-time and part-time engineers. They maintain a language that powers 70% of the web while AI companies invest billions into models that can find — or exploit — its flaws. The asymmetry between the resources spent discovering vulnerabilities and the resources available to fix them is the real vulnerability. AI-accelerated vulnerability discovery is not a one-off event. It is a permanent change in the threat landscape. Every legacy codebase — and PHP is merely the most prominent — now faces a compressed timeline between flaw discovery and exploitation. The question is whether funding and institutional support for open-source maintenance will scale to match, or whether we continue to build trillion-dollar economies on code maintained by a skeleton crew.
