Up to 70% of world’s websites at risk after AI discovers critical security flaw

PHP's vulnerability isn't theoretical—it's a live threat to the operational backbone of the internet. PHP, which runs WordPress, Facebook, Wikipedia, and roughly 77 percent of all websites with a known server-side language, contains a critical flaw that allows unauthenticated remote code execution. This means a attacker needs no login credentials, no exploit chain, no social engineering. They identify a vulnerable PHP installation and execute arbitrary commands with the privileges of the web server itself. The PHP development team disclosed this on their official website Wednesday, and patches became available immediately—but the real problem is adoption. Millions of smaller sites, municipal websites, medical portals, and e-commerce platforms run outdated PHP versions. Many administrators don't patch immediately or at all. The gap between vulnerability disclosure and actual remediation typically spans months.

What's genuinely at stake here isn't speculation about future breaches—it's control of live infrastructure. A successful exploit gives an attacker the ability to install persistent backdoors, exfiltrate databases containing customer records and payment information, modify website content to inject malware into visitors' browsers, or weaponize the site as part of a botnet. For a small business operating on WordPress or a hospital managing patient portals through PHP-based systems, this isn't an inconvenience—it's operational compromise. The financial impact scales from immediate ransomware demands to regulatory fines under GDPR or HIPAA, to permanent reputation damage. Larger enterprises have security teams monitoring patches and applying them within days. Smaller organizations, which comprise the majority of PHP deployments, often lack that infrastructure entirely.

The vulnerability echoes the Shellshock flaw in Bash (2014), which similarly affected enormous swaths of internet infrastructure with a deceptively simple execution mechanism. Like Shellshock, this PHP flaw highlights a recurring problem: critical software embedded in millions of systems with no mandatory update mechanism. System administrators can ignore patches indefinitely. There's no kill switch, no forced upgrade, no notification system that reaches actual decision-makers at small organizations. The patching burden falls entirely on individual operators, many of whom don't even know they're running vulnerable code.

The conservative argument here is straightforward: this demonstrates exactly why open-source infrastructure maintained by volunteer committees creates national security risk. PHP is stewarded by a decentralized development community with no accountability structure and no enforcement mechanism. When critical vulnerabilities surface, there's no way to compel the millions of website operators to actually patch. Compare this to proprietary systems where vendors can force updates, or government-controlled infrastructure where mandates can be issued. The alternative—waiting for the vulnerability to be exploited at scale, then managing the fallout through breach notifications and legal liability—is precisely backward. This also reflects the broader fragility of a web stack built on aging, unmaintained code. Millions of websites still run PHP versions from 2015 or earlier because the operator doesn't know they should update, can't afford to hire someone to do it, or fears breaking dependencies. That's not a technical problem—it's a coordination problem that markets alone won't solve.

The immediate watch: monitoring how many major hosting providers force automatic updates on shared hosting instances in the next 7-10 days. Cloudflare and similar edge providers can patch at their layer, but self-hosted WordPress and custom PHP applications remain exposed. The second metric is exploit development—researchers will reverse-engineer the patch to understand the exact vulnerability mechanism, and public proof-of-concept code typically emerges within two weeks of a critical disclosure. Once that happens, automated scanning and attacks accelerate exponentially. CISA's vulnerability database should show update trends over the next month. If adoption rates remain below 40 percent by mid-February, expect the first high-profile breaches to be publicly disclosed by late Q1. That's when the actual damage becomes undeniable.