AI-found PHP flaws knock sites offline and threaten parts of the old web

Security firm Wiz says exploiting the bug once took an exceptionally complex chain of steps, but powerful AI models have made that kind of work much easier. Amazon’s threat team says it saw an exploit attempt on 17 October, days before the patch. The NSA’s cybersecurity team and the UK’s National Cyber Security Centre advised taking systems offline if they couldn’t update at once. Old services that can’t be patched, such as two long-running Japanese mobile games, are shutting down. The PHP Foundation says it knows of no successful remote code execution, but calls updating “imperative”.

Why it matters

This shows AI cutting both ways: models that help defenders find a decades-old flaw also make such flaws easier to exploit, and attacks surged within hours of the disclosure. It also exposes the web’s long tail of unmaintained software. Sites that nobody can update may simply disappear, taking pieces of internet history with them.