Up to 70% of world’s websites at risk after AI discovers critical security flaw

PHP's vulnerability isn't theoretical—it's a live threat to roughly 2 billion websites running on the language, from WordPress blogs to major e-commerce platforms to government portals. The PHP team disclosed the flaw Wednesday, which means the clock started ticking immediately. Bad actors now know what to look for. The vulnerability allows remote code execution, meaning someone could potentially plant malware, steal databases, or lock administrators out of their own systems without needing legitimate login credentials. This isn't a patch-it-and-forget-it scenario either—PHP runs server-side, which means the hosting infrastructure itself becomes the attack surface.

The practical impact depends on how fast administrators move. WordPress alone accounts for roughly 43% of all websites and runs on PHP, making it a natural bull's-eye. Small businesses, nonprofits, and regional hospitals that can't afford dedicated security teams are most exposed. A ransomware gang could theoretically compromise a local health network's patient records or lock a mom-and-pop retailer out of their payment processing. The window between public disclosure and active exploitation is typically measured in days, not weeks. Companies running outdated PHP versions—and many do—face the highest risk.

The 2016 Equifax breach offers a grim precedent. Equifax delayed patching a known Apache Struts vulnerability for months, resulting in the theft of 147 million Americans' social security numbers and credit card data. The difference here is scale: this flaw affects the foundational layer of the internet itself, not a single company's framework. If a major hosting provider gets hit, the collateral damage cascades across thousands of unrelated websites using that infrastructure.

The skeptical read is straightforward: PHP has been patched after major vulnerabilities dozens of times over two decades, yet new ones keep emerging. The real issue isn't that PHP has a flaw—it's that the internet runs on infrastructure maintained partly by volunteers and partly by companies operating on razor-thin margins. Expecting a mom-and-pop business to have a security team constantly monitoring for zero-days is unrealistic. The consolidation of the web into so few languages and frameworks has created a single point of failure at massive scale. This is what happens when economic incentives favor speed over security.

Watch for the PHP team's patch release timeline—they've indicated a fix is coming but haven't locked in a date. Also monitor whether hosting providers like GoDaddy, Bluehost, or AWS announce coordinated mitigation steps. Any major website outages in the coming week could signal active exploitation in the wild. Congressional cybersecurity committees are already being briefed, so expect pressure on the Biden administration to issue guidance to federal agencies on mandatory patching deadlines.