AI found 20-year-old holes in PHP. Governments took websites offline

Two critical holes in PHP, some dating back to 2004 and present on about 70 percent of websites, were found with the help of AI by OpenAI's "Patch the Planet" programme and by Wiz. The NSA warned about them and advised taking unpatched sites offline; no exploits were seen before disclosure, but AI now helps attackers adapt exploits across versions, so it is a race to update (TechCrunch).

The race had visible consequences within a day. On 22 October, cantonal websites in Basel, online services of Swiss universities and PHP applications of the Swiss federal administration were taken offline as a precaution. The national cybersecurity office knew of no attacks but could not rule out unreported ones, and said: install the patches now (watson).

The case answers both camps. AI is why the holes were found after twenty years, and AI is why attackers will use them faster. But the defence is still the most ordinary one: knowing what you run and updating it. A small business with a shop or website on PHP or WordPress needs no AI strategy this week. It needs to know its PHP version and who is responsible for updates.

Someone has to do that work, in every town and every company. Website maintenance and basic security are skills that people leaving shrinking jobs can learn quickly and sell locally. Our bootcamp students learn them on real websites.

Practical step: ask your hosting provider in writing for the PHP version and patch status of your servers, and set a monthly update date.