A critical PHP vulnerability that had quietly existed for decades forced website operators into an uncomfortable choice: patch immediately or take their sites offline. The flaw, discovered under an OpenAI and Wiz initiative called Hack the Planet, underscored how much of the internet rests on software few people think about. PHP—officially Hypertext Preprocessor—powers roughly 70% of websites, including content management systems like WordPress and Drupal. Tens of millions of sites rely on it.
A Language Nobody Notices Until It Breaks
On TechCrunch’s Equity podcast, co-host Kirsten Korosec pointed out that many website owners have no idea their sites even use PHP. The language is often buried beneath layers of tooling and third-party services. Sean O’Kane described the internet’s base level as something held together by glue and dreams. The incident, he said, amounted to a real reckoning moment.
The vulnerability itself was not new. It had been present for decades before researchers found it. That timeline complicates the usual narrative of fast-moving cyber threats: sometimes the most dangerous bugs are the ones that have been sitting in plain sight all along.
Human Discovery, AI Exploitation
During the podcast, Anthony Ha initially said that AI companies had used large language models to find the flaw. He corrected himself: human researchers found it, then used AI to exploit the bug. The distinction matters. AI did not independently discover the vulnerability, but it played a role in demonstrating how it could be attacked.
The discovery took place under the Hack the Planet initiative, a joint effort between OpenAI and Wiz, the security firm now owned by Google. AI companies like Google and OpenAI had people searching for vulnerabilities, according to the discussion. The implication is that AI tools could make finding future flaws easier—not by replacing human researchers, but by accelerating the exploitation phase.
Disclosure Chaos and a Hacker Race
Revealing a vulnerability is always a balancing act. Patches must reach defenders, but the same information can arm attackers. In this case, some parties released details ahead of an embargo, triggering a race. Many actors rushed to exploit the flaw after disclosure. Cloudflare CEO Matthew Prince posted that PHP2Shell, the exploit tied to the vulnerability, had seen millions of attempted hacks.
The rollout drew criticism, including accusations that OpenAI’s post was self-congratulatory. O’Kane noted the backlash during the podcast. The episode highlighted a structural problem: there is no easy way to discreetly notify every website controller, especially when millions of sites are affected.
Honeypots and Takedowns
Amazon operates a honeypot network that detected exploitation attempts before the public announcement, according to Korosec. That early warning offered a glimpse of what was coming. Even so, governments and popular websites took their sites down temporarily rather than risk compromise.
Well-capitalized firms can defend better than small sites, Korosec said. The resource gap is stark. Small operators and government sites often lack the staff or budget to respond quickly, leaving them exposed long after larger organizations have patched.
The Quiet Cost: Link Rot
Some sites will never come back. Link rot—the gradual decay of hyperlinks as destinations disappear—will increase as sites shut down instead of patching. 404 Media’s breakdown on the subject, cited by Korosec, points to a lasting consequence: historical content may become inaccessible. The web’s memory is not as permanent as it seems.
The incident also raises broader questions about the internet’s dependence on open-source technology. PHP is free, widely used, and maintained by a community. When a flaw emerges in such foundational software, the ripple effects are enormous and difficult to contain.
What Comes Next
The event may spur new security startups or greater use of open-source security tools, according to the podcast discussion. AI agents could make vulnerability discovery easier in the future, adding pressure on defenders. For now, the PHP vulnerability serves as a reminder that the internet’s plumbing is both essential and fragile—and that disclosure, however necessary, can set off a scramble no one fully controls.
