AI Finds Ancient Security Holes in 70% of Websites

Two critical security holes have been found in PHP, the programming language that powers about 70% of all websites—over 33 million sites, including many WordPress blogs. The flaws have been lurking since 2004, but were only discovered now thanks to AI tools from OpenAI and Google's Wiz. The NSA warns that if a site can't be patched right away, it should be taken offline to prevent attacks.

These holes could let hackers break into a website's server and steal or change data. The good news: patches are already available, and there's no evidence hackers have used these flaws yet. The bad news: now that the flaws are public, hackers know about them and may race to exploit unpatched sites. If you run a website, you must update PHP to the latest version (8.5.12) or ask your hosting provider to do it. Older versions like PHP 8.1 and below are no longer supported and need extra work.

played a dual role here. It helped researchers find the flaws before bad guys did, but it also makes these flaws easier to exploit. As Wiz explained, AI can adapt attacks to different server setups, which used to be a major barrier for hackers. So while AI helped prevent a disaster, it also raises the risk. The race is on to patch millions of websites before hackers strike.

For everyday internet users, this is a reminder that the sites you use rely on software that needs constant updates. If you run a website, act now: update PHP or contact your host. If you're just browsing, you don't need to do anything, but be aware that some sites may be temporarily offline while they patch.