Up to 70% of world’s websites at risk after AI discovers critical security flaw

PHP, the open-source programming language that underpins WordPress, Facebook's backend infrastructure, and roughly 77% of all websites with known server-side programming languages, has a vulnerability so severe that attackers could execute arbitrary code on compromised servers. The PHP development team disclosed the flaw on Wednesday, and while patches are already available, the practical reality is grimmer: hundreds of millions of websites run outdated versions of PHP that administrators never update, either through neglect or because they're locked into older hosting environments. The vulnerability exists in PHP's type juggling system—a core feature that allows the language to automatically convert between data types—and attackers can exploit it by sending specially crafted requests that trick the system into executing malicious commands with the same permissions as the web server itself.

The actual exposure here breaks down into tiers of real-world risk. High-traffic targets like news sites, e-commerce platforms, and SaaS tools with competent security teams will patch within days. But the vast middle layer—small business websites, local government portals, medical practices with WordPress sites, abandoned corporate blogs still processing data—largely won't. Hosting providers that manage shared server environments face particular pressure: updating PHP globally could break legacy applications that clients depend on but can't afford to upgrade. Individual users have almost no way to know if their hosted website uses vulnerable PHP, and most hosting companies won't proactively force updates without customer approval.

The mechanism matters because this isn't a simple authentication bypass that requires guessing credentials. Type juggling vulnerabilities are notoriously difficult to patch without breaking existing code, since developers have built applications around PHP's loose comparison logic for twenty years. The fix requires both the PHP developers to release patches and then convincing millions of site administrators to apply them—a distribution problem that resembles trying to get all car owners to replace a faulty part when many don't know they own that part.

The conservative reading is straightforward: this is what happens when critical global infrastructure is stewarded by volunteer open-source communities with no liability, no corporate accountability, and no mechanism to force compliance downstream. PHP powers everything from your bank's login page to your doctor's patient records system, yet nobody on earth can mandate an update. The free software model works fine when consequences are limited to individual developers' projects, but we've built too much essential plumbing on top of it. If China or Russia decided to deploy this exploit against vulnerable hosts, there's no central authority that could order an emergency response. That's not a feature of decentralization—that's a flaw in the architecture of the internet itself.

Watch for two specific indicators: first, whether major hosting providers like GoDaddy, Bluehost, and AWS announce mandatory upgrade timelines in the next two weeks, which would signal they're prioritizing security over customer friction. Second, whether any major breach claims the PHP flaw as its entry vector—that would force media attention and scare smaller sites into patching. The patch availability window typically closes after 30 days, at which point security researchers publish detailed exploitation guides and automated scanners light up every unpatched server. By mid-February, if more than 40% of websites remain unpatched, the exploit will move from theoretical to actively hunted by criminal syndicates.