70% of the World’s Websites Are Vulnerable. Is Yours One of Them?

Two decade-old flaws in PHP, the language behind roughly 70% of the world’s websites, were found not by a hacker but by AI models working for the defenders. That is the good news. The bad news is what it tells us about every other bug still sitting in your stack.

On Tuesday, the PHP security team shipped emergency patches for two vulnerabilities that had been hiding in its codebase for more than ten years. As the Wall Street Journal reported, the bugs put up to 70% of the world’s websites at risk. Wiz, the Google-owned security firm that helped find them, called them “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” The FBI told website operators to patch immediately.

Here is the part I want every CEO and CFO to sit with. These bugs, now called PHP2Shell, were not discovered by a nation-state crew or a ransomware gang. They were discovered by OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, pointed at the PHP source by researchers at Wiz, OpenAI and a security firm called Calif. The models did not just find the flaws. According to Wiz, they turned them into working exploits across multiple applications in a matter of hours, work that would have taken skilled humans weeks because, in Wiz’s words, it “required an exceptionally complex chain of steps.”

Ten years of human eyes on open-source code missed them. A few weeks of machine attention found them.

The story is not PHP. The story is the clock.

PHP matters because of its reach: WordPress, Laravel, Magento, half the e-commerce and content infrastructure on the internet, and a very large share of the American mid-market web estate. Both flaws carry a CVSS score of 9.2. One lets an attacker execute code on the server without logging in. The other can leak process memory, which means passwords, API keys, session tokens and certificates belonging to other users’ requests. Patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older than 8.2 gets no official fix, only source backports, which in practice means a large number of legacy systems will stay exposed for months.

If you run a web business, your CTO should already have an inventory of every PHP deployment, including the ones hiding inside appliances, hosting control panels and that vendor portal nobody has touched since 2019. If they do not have that list by Friday, that is the first conversation to have.

But the patch cycle is the tactical layer. The strategic layer is this: OpenAI described the gap between discovery and public disclosure as a “Defender’s Window,” and Greg Brockman said the industry has entered a phase in which models can find vulnerabilities with internet-scale impact. He is right, and it cuts both ways. The same capability that let defenders find PHP2Shell first is available, in some form, to anyone with an API key and bad intentions. Reports of exploitation attempts were circulating before the patches even shipped. Forbes reported just last month on a criminal who used commercial AI models to lift more than 600,000 card numbers from over a hundred websites.

The era in which a vulnerability could sit undiscovered for a decade is over. The era in which the discovering party is usually friendly has not begun. We are in the gap between those two, and that gap is where the C-suite decisions have to be made.

What I would do this quarter if I were sitting in your chair

I will be direct, because I have watched three of our own portfolio companies go through variants of this exercise this year.

First, stop treating security testing as an annual audit. The annual penetration test was designed for a world where attackers moved at human speed. PHP2Shell was weaponised in hours. Your testing cadence has to match the attacker’s cadence, which now means continuous, automated, AI-assisted testing against your own production code. At iTester we have moved most of our security-testing clients to monthly AI-driven scans with human validation, and the finding rate is not subtle. The bugs were always there. The tooling finally sees them.

Second, run the models against yourself before someone else does. Brockman’s advice to defenders was to “apply models to their own systems.” That is not a research suggestion; it is an operating instruction. If GPT-5.6 Sol can find a ten-year-old use-after-free in PHP, it can find the one in the custom middleware your team wrote in 2021. The cost of running frontier models against your codebase is a rounding error next to a breach that triggers the SEC’s four-day material-incident disclosure rule, a state attorney general’s inquiry, or a class action under California’s privacy statutes.

Third, put AI security on the board agenda as a line item, not a footnote in the CISO’s slide. Most boards I speak with still frame AI as a productivity or growth question. After this week it is a resilience question. The right board question is not “are we using AI?” It is “what does our attack surface look like to an AI, and who is looking at it first, us or them?”

Fourth, fix the inventory problem for good. The companies struggling most this week are not the ones with the worst security teams. They are the ones who do not know where all their PHP lives. Shadow IT, acquired subsidiaries, agency-built microsites, that WordPress instance marketing spun up for a conference. You cannot patch what you cannot find, and an AI attacker will find it for you.

The regulatory clock is already running

For public companies, the SEC’s cybersecurity rule means a material PHP2Shell compromise lands in an 8-K within four business days of being judged material. That judgment is a board-level call, and it is much easier to make when you can show the audit committee a dated patch log than when you are reconstructing what happened from server logs. For everyone else, CISA’s known-exploited-vulnerabilities list and the FBI’s advisory create the paper trail a plaintiff’s lawyer will use to argue you were warned. “We did not know” stopped being a defence on Tuesday afternoon.

The uncomfortable conclusion

For twenty years the implicit bargain of the open-source web was that enough eyes would eventually catch the serious bugs. PHP2Shell proves the eyes were never enough. It took machines to see what a decade of humans walked past.

That should reassure you and frighten you in equal measure. Reassure, because the defenders got there first this time. Frighten, because “this time” is doing a lot of work in that sentence.

The C-suite question for the rest of 2026 is simple to state and hard to answer: when the next PHP2Shell is found, which side of the Defender’s Window will your company be on?