I run my offerings on WordPress. When the PHP headlines hit this week, my provider had already handled it before the news broke. That’s the experience most companies should have had. The headlines told a different story.
What happened
“70% of the internet at risk.” That was the headline. Government websites in Europe went dark. Parts of Wikipedia came down. Japan’s prime minister went on social media and told companies to check their websites (Al Jazeera).
The cause was two critical flaws in PHP, the programming language that does the behind-the-scenes work on a huge share of websites. When you load a page, something on a server looks up your account, checks your password, saves the form you filled in and builds what you see. On a lot of sites, including anything built on WordPress, that something is PHP.
Think of PHP as the plumbing in a building. The defect wasn’t in the sink or the faucet. It was in the pipe. A company could build its website carefully and still be exposed, because the problem sat underneath its code. The fix was updating PHP itself, which the PHP project released on October 21 (The Hacker News).
What “70%” actually means
The 70% is PHP’s share of websites where the server-side language is known. It’s market share, not a count of vulnerable sites. It’s like saying 70% of buildings have plumbing, so 70% of buildings are flooding. They aren’t.
Estimates of servers actually exposed on the internet ran from about 1.3 million to 1.9 million worldwide (CyberScoop). That’s still a big number. But most of those servers aren’t run by companies like yours.
Attempts also aren’t breaches. Cloudflare said attack attempts went from tens of thousands in the first 45 minutes to millions within the day (Cybernews). At the same time, researchers found most of the attack code circulating online didn’t work or just crashed the server, and the sites that went dark were mostly precautions, not confirmed break-ins.
Why an old bug became critical
Here’s the part I think matters more. The vulnerable code had been in PHP for about 14 years. A PHP developer spotted signs of one of the flaws during an audit in 2024. Nobody could find a practical way to attack it, so it wasn’t treated as urgent, and the fix stalled.
That’s normal. Software is full of bugs that are possible in theory and very hard to exploit in practice. For years, the difficulty was the protection. We covered the same idea when Bank of America hired 1,000 contractors to patch old weaknesses.
The bug didn’t change. The cost of exploiting it did. Two research teams found these flaws independently this summer, one working with OpenAI and one owned by Google, and both used AI models. One team said a single researcher did in a week what would have taken a world-class team months (Wiz). AI’s biggest help wasn’t spotting the bug. It was turning a hard-to-exploit bug into a working attack.
Think of a lock that could always be picked, but only by a master locksmith with a full day and the right tools. You didn’t worry much, because there aren’t many master locksmiths. AI didn’t change the lock. It made a lot more people capable of picking it.
What it means for your company
Someone will ask you about this, whether it’s your CEO, your board or a client. Sort your exposure into three buckets.
- Managed platforms. A hosted website builder, a major hosting company, a SaaS product. For most companies, that’s nearly everything. The provider handled it. Confirm and move on.
- Vendors that hold your data. Payroll, HR, your CRM, a client portal. You don’t fix anything. Send one email, or watch for the one they send you.
- Things you run yourself. A customer portal a contractor built years ago, an old marketing site, an internal tool someone set up and left. This is where it can actually matter.
Finance has a good way to find bucket three: your AP and card data. A monthly hosting charge with no clear owner is often a system nobody is maintaining. It shows up as a payment, even when it’s not on IT’s list. And if you’ve built your own site or tool with AI’s help, it’s probably in this bucket.
Then expect more of this. Think about old, unsupported software like an asset whose useful life just got shortened. Nothing about the asset changed overnight. The assumption that let you carry it, “it’s old, but stable, and too hard to attack,” stopped holding. Any risk you accepted on that basis deserves a second look, along with how fast you and your vendors can apply an emergency fix.
Key takeaways
- For most organizations, this headline means very little. If you’re on managed platforms, the right response is confirmation, not crisis.
- “70% of the internet” is market share, not a count of vulnerable sites.
- It matters where you run something yourself that nobody maintains. Your AP data is a good place to start looking.
- The bug wasn’t new. AI made it cheaper to exploit, and that will keep happening.
Want the CPE credit? Take the full lesson on EverydayCPE and earn 0.2 CPE credits: The PHP Flaw: What It Really Means
Leave a Reply