AI didn’t break PHP. It helped expose weaknesses we’ve been living with for years.

On October 21, PHP released emergency fixes for two critical security flaws. In vulnerable setups, attackers can run code on a web server without logging in.

This isn’t just a WordPress plugin problem. It’s in PHP itself—the software underneath many websites and business systems. Updating your website doesn’t necessarily update that underlying software.

What went wrong? PHP could mishandle memory when a request failed, or leave behind information that the next request shouldn’t use. Researchers used AI to help show how those weaknesses could become real attacks.

And the PHP Foundation says fixing the underlying problem was delayed by difficult compatibility decisions, limited resources, and a decision process that needed to change.

So yes, this is serious. But widespread use is not the same as widespread compromise. Not every PHP website has been hacked, and fixes are available.

As a CTO, here’s my bigger takeaway: AI can help defenders find and fix old flaws. It can also help attackers exploit them faster. We should expect more pressure on how quickly we respond—not assume catastrophe.

We need to educate ourselves about AI and about the systems we already depend on. Know what runs your website. Know who patches it. Verify the fix is actually running. And have tested backups and monitoring.

Don’t panic. Don’t assume your hosting company handled everything, either.

Comment “PHP,” and I’ll send you a practical guide for GoDaddy, AWS, and your own server—so you know what to ask and what to do next.