The PHP Patch Panic: Is the Internet's Foundation Cracking?

A decades-old vulnerability in the open source programming language PHP forced website owners this week to patch immediately — or take their sites offline entirely to stay safe. Cloudflare CEO Matthew Prince has already reported the flaw escalating to millions of attempted hacks of PHP2Shell.

That's the hardest number in this story, and it frames everything else. The so-called "PHP-ocalypse," discussed on this week's TechCrunch Equity podcast by Kirsten Korosec, Sean O'Kane and Anthony Ha, exposed how fragile the internet's foundations really are — and how AI could stress-test them further.

What actually happened?

Human researchers participating in OpenAI and Wiz's "Hack the Planet" initiative discovered the vulnerabilities, using AI to exploit the bug. Wiz, now owned by Google, was among the companies whose security efforts surfaced the flaw.

The vulnerability wasn't new. As Anthony Ha noted on the podcast, it had existed in PHP for decades — and no one knew about it. Once security teams found it, the calculation changed: if researchers could locate the flaw using AI tools, so could attackers. The only way to distribute patches was to announce the vulnerability publicly, creating what Ha called "this very panicked situation."

PHP, officially Hypertext Preprocessor, powers the content management systems behind WordPress and Drupal — software running roughly 70% of websites, according to Korosec. That's tens of millions of sites. Many owners don't even realize their sites run on PHP at all.

How bad did it get?

The fallout split in two directions this week. On one side, labs and companies like Google and OpenAI pushed people to find and fix vulnerabilities. On the other, hackers rushed to exploit them.

Kirsten Korosec pointed to a telling detail from Amazon. The company operates a honeypot — essentially a decoy network — and its blog post revealed attempted exploits of the vulnerability before it was publicly announced. Amazon has the capital, tools and know-how to catch this activity. Korosec's concern: countless websites, including government sites, simply don't have that level of attention.

O'Kane called the episode "a real reckoning moment" — one that reveals the downside risk of building so much of the internet on open source technology. "When you really get down to the bone level of the internet, it is held together with glue and dreams," he said.

The disclosure rollout itself drew criticism. Some people got ahead of the embargo, setting off a race among hackers. Others took issue with what O'Kane described as "chest beating" in OpenAI's post about the discovery.

What does this change for security practitioners?

For anyone running web infrastructure, the practical question is disclosure logistics. With most vulnerabilities, a researcher can quietly alert one company and contain the problem. A flaw this deep and this fundamental doesn't allow that. As O'Kane put it: "you can't go around and tell everybody discreetly." He half-joked that sufficiently advanced AI could theoretically task a billion agents to email every website administrator — and noted we now miss the days of easily identifiable webmasters.

The consequences extend beyond patched code. Korosec highlighted a 404 Media breakdown on link rot: governments, companies and small neighborhood sites that chose shutdown over patching will simply disappear, taking pieces of internet history with them.

Is AI the accelerant or the alarm?

The uncomfortable dynamic is that the same tools making vulnerabilities easier to find — LLMs and autonomous AI agents — also make them easier to weaponize. O'Kane framed the scale starkly: how many times over the last 10 years has one hobbyist maintaining a tiny repository caught something nefarious and saved the internet's infrastructure from crumbling? Now multiply that by a billion people with access to advanced AI and the ability to task single-minded agents.

Korosec went further, worrying about a "next level of prepper doom": "you could see how banks could get exploited, and [with] data and privacy concerns, it just feels a lot bigger than we can fix right now."

Her forward-looking question is the one practitioners should watch: whether new security startups emerge from this episode, or whether companies turn to open source tools — like those offered by Nvidia — to build protective layers. Either way, as O'Kane concluded, this marks "clearly a new frontier in cybersecurity."