PHP, the software language powering an estimated 70% of websites, has rushed out patches for two critical security flaws. Researchers found the bugs with help from OpenAI’s GPT-5.6 Sol model. The US NSA has urged organisations to update immediately — or take vulnerable systems offline.
The flaws, called PHP2Shell, sit in PHP’s core engine, not merely in individual websites. They could let attackers run malicious code or read sensitive server memory without logging in. That means even well-built business websites could be exposed if their PHP software is unpatched.
This does not prove that all pre-AI software was “necessarily creaky.” Much of it has worked reliably for decades, but old code was written for a world where hidden weaknesses could remain undiscovered for years. AI now scans, reasons through, and connects those weaknesses far faster than traditional manual audits.
For businesses, the lesson is urgent:*-based* systems now, review hosting and web-application security, and treat AI-assisted vulnerability discovery as a new baseline patch PHP. The same technology that finds flaws can also be used by attackers, making rapid disclosure and patching essential.
*AI HAS TURNED OLD CODE’S HIDDEN CRACKS INTO A GLOBAL SECURITY TEST.*
Sanjay Sahay
Have a nice evening.