AI Just Found 22-Year-Old Flaws in 70% of the Web. Now What?

According to TechCrunch, OpenAI and Google’s Wiz security team uncovered severe vulnerabilities hidden inside PHP since version 5 was released back in 2004. These ancient flaws affect approximately 70% of all websites on the internet, creating an immediate scramble for server updates.

Why did it take 20 years to find these holes?

For over two decades, these security gaps remained tucked away because human code auditors struggled to trace complex memory layouts across countless configurations. That changed when artificial intelligence entered the security space. Using models like GPT-5.6 Sol and Wiz Atlas, researchers successfully mapped out paths that humans missed for generations.

Yet this discovery exposes a dangerous paradox. Before generative models advanced, these vulnerabilities were too complex for average hackers to exploit at scale. Today, large language models can automatically adapt an exploit to fit different PHP versions and memory structures within seconds.

How to check and secure your servers

If your applications run on PHP, immediate action is required to prevent server infiltration. Follow these steps to protect your infrastructure:

• Check your PHP version: Run php -v on your server terminal. Versions 8.1 and older are no longer supported and will not receive official security patches.
• Update immediately: Upgrade your server environment to the current stable release, version 8.5.12, where patches have already been applied by the PHP Foundation.
• Consider downtime: If your web hosting provider or system architecture makes an immediate patch impossible, the U.S. National Security Agency advises taking the vulnerable site offline temporarily.

Is your application at risk?

While content management systems like WordPress stated that the core software is not inherently to blame, any site running on unpatched hosting servers remains dangerously exposed. Development teams can no longer rely on obscurity or the age of a codebase to protect legacy web applications from automated threats.